Privacy Policy — 12bank Data Commitment

This Privacy Policy applies to all personal data collected, processed, and stored by 12bank in connection with the operation of the 12bank online casino and sports betting platform accessible at 12bank.bio. It governs data collected through the website, any associated mobile-optimised interfaces, customer support channels, and all other touchpoints through which you interact with 12bank services.

By registering a 12bank account, making a deposit, placing a wager, or otherwise using the 12bank platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this policy, you should not use 12bank services.

This policy should be read alongside the 12bank Terms and Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and the Terms and Conditions on matters of data handling, this Privacy Policy shall prevail.

12bank is committed to handling your personal data with integrity, transparency, and care. We apply industry-standard technical and organisational security measures to protect your information, and we process data only for purposes that are legitimate, necessary, and proportionate to the services we provide to players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and throughout Bangladesh.

For the purposes of this Privacy Policy, 12bank is the data controller responsible for the personal data of players registered on the 12bank platform. As data controller, 12bank determines the purposes for which personal data is collected and the means by which it is processed.

All data protection enquiries, access requests, deletion requests, and complaints should be directed to the 12bank Data Protection contact at [email protected]. Please include "Privacy Request" in the subject line of your correspondence to ensure your query is routed to the appropriate team. 12bank will acknowledge all data-related requests within 5 business days and provide a substantive response within 30 calendar days.

12bank collects personal data in the categories set out below. We collect only what is necessary for the specific purpose identified, and we do not collect data speculatively or in anticipation of future uses that are not currently defined.

12bank does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (except where voluntarily disclosed in connection with a responsible gaming self-exclusion request), criminal conviction data (except where surfaced through fraud screening), or biometric data for identification purposes.

12bank collects personal data through the following means:

• Directly from you: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or respond to a survey or promotion.
• Automatically: When you use the 12bank platform, our servers automatically record Technical Data and Usage Data as described in Section 3. This data is collected through server logs, session cookies, and analytics tools operating within the 12bank infrastructure.
• From payment processors: When you initiate a deposit or withdrawal, our integrated payment partners (including bKash, Nagad, and Rocket gateway services) transmit transaction confirmation data including masked account identifiers and transaction reference numbers to 12bank for reconciliation purposes.
• From third-party fraud and identity verification services: 12bank may use third-party identity verification providers to cross-check the accuracy of documents submitted during KYC. These providers return a verification status code and confidence score to 12bank — they do not retain your documents beyond the immediate verification transaction.
• From responsible gaming registers: Where a Player has previously registered a self-exclusion with a recognised problem gambling support service, 12bank may receive notification of that exclusion through industry data-sharing arrangements for the purpose of enforcing the exclusion on our platform.

12bank uses the personal data we collect for the following purposes. Each purpose is matched to a lawful basis for processing as set out in Section 6.

• Account creation and management: To register your account, authenticate your identity at login, manage your account settings, and maintain the integrity of your player profile throughout your use of the platform.
• Age and identity verification: To confirm that you are at least 18 years of age and that the information you have provided is accurate. This is a mandatory obligation and a condition of continued account access.
• Payment processing: To process deposits from and withdrawals to your verified payment methods, reconcile transaction records, and investigate payment discrepancies.
• Game delivery and platform operation: To operate the games, betting markets, and casino services you access on the 12bank platform, maintain accurate bet settlement records, and resolve game disputes.
• Responsible gaming compliance: To monitor your play patterns for signs of problem gambling behaviour, enforce deposit limits and self-exclusion requests you have set, and send responsible gaming communications where required.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, money laundering, and abuse of bonuses or promotional offers.
• Legal and regulatory compliance: To meet any obligations imposed by applicable law, court orders, or directions from law enforcement agencies, including anti-money laundering (AML) and counter-terrorism financing (CTF) screening.
• Customer support: To respond to your enquiries, resolve complaints, and maintain a record of your support interactions for quality assurance and dispute resolution purposes.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given explicit consent or where we have a legitimate interest that is not overridden by your privacy rights. See Section 13 for opt-out details.
• Platform improvement: To analyse aggregated usage data for the purpose of improving the 12bank platform experience, identifying technical issues, and optimising game content and layout. This analysis uses anonymised or pseudonymised data wherever possible.

Every processing activity carried out by 12bank is grounded in at least one of the following recognised legal bases:

• Contract performance: Processing that is necessary to provide the 12bank services you have contracted for when registering an account — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory obligations, including KYC identity verification, age verification, AML screening, and responding to law enforcement requests.
• Legitimate interests: Processing necessary for the legitimate interests of 12bank or third parties, where those interests are not overridden by your privacy rights. This includes fraud prevention, platform security, responsible gaming monitoring, and internal analytics. We conduct a balancing assessment for each legitimate interest processing activity.
• Consent: Processing based on a freely given, specific, informed, and unambiguous indication of your agreement — primarily for direct marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where consent is the legal basis, 12bank will always present a clear opt-in mechanism and will not make the use of core platform services conditional on consent to marketing or non-essential processing.

12bank may share your personal data with the following categories of third parties under the conditions described:

• Payment service providers: bKash, Nagad, Rocket, Upay, and bank payment gateways receive the minimum data necessary to process your transaction — typically your registered mobile number or bank account identifier and the transaction amount. These providers process data under their own privacy policies and applicable financial regulations.
• Identity verification providers: Third-party KYC and age verification services receive copies of identity documents you submit for the purpose of verifying their authenticity. Data is transmitted over encrypted connections and is processed under contractual data protection obligations.
• Fraud prevention and AML screening services: 12bank uses industry-standard fraud screening tools that may cross-reference account and transaction data against known fraud databases. These services return risk scores and do not retain full copies of your personal data.
• Game software providers: Providers such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi operate game servers that process certain session data (IP address, session ID, bet amounts) as part of game delivery. These providers are bound by contractual data protection terms and do not use this data for purposes unrelated to game operation.
• Law enforcement and regulatory authorities: 12bank will disclose personal data to competent authorities — including Bangladesh Financial Intelligence Unit (BFIU) and law enforcement agencies — where required by applicable law, court order, or lawful regulatory request. Where legally permissible, 12bank will notify affected players of such disclosures.
• Professional advisers: Lawyers, auditors, and compliance consultants engaged by 12bank may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of all or part of 12bank's business, personal data held by 12bank may be transferred to the acquiring entity. Affected players will be notified of any change in data controller status prior to the transfer taking effect.

12bank uses cookies and similar tracking technologies to operate the platform, maintain your login session, detect fraudulent activity, and analyse usage patterns for platform improvement. The following categories of cookies are used:

12bank does not use third-party advertising cookies, retargeting pixels, or social media tracking pixels. The analytics data we collect is processed within our own infrastructure and is not shared with advertising networks or data brokers.

You may manage functional and analytics cookies through your browser settings. Note that disabling essential or security cookies will prevent you from accessing the 12bank platform, as these are technically necessary for secure operation.

12bank retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your account relationship with 12bank, plus a mandatory post-closure retention period.
• KYC and identity documents: Retained for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, or longer if required by applicable financial regulations.
• Game play and bet settlement records: Retained for 3 years from the date of the relevant session or settlement, to allow for the resolution of disputes within reasonable limitation periods.
• Customer support correspondence: Retained for 3 years from the date of the last interaction in the relevant support thread.
• Technical and log data: Server logs are retained for 12 months for security analysis and then purged. Aggregated, anonymised usage analytics may be retained indefinitely.
• Marketing consent records: Retained for the duration of your account relationship plus 3 years post-closure, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data cannot be immediately deleted due to backup or archival schedules, 12bank will isolate it from further active processing until deletion is complete.

12bank implements a layered approach to data security, combining technical, organisational, and procedural controls to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• Encryption in transit: All communication between your device and 12bank servers uses Transport Layer Security (TLS 1.2 minimum). This includes the website, API calls, and payment gateway connections.
• Encryption at rest: Sensitive stored data, including identity documents and financial records, is encrypted using AES-256 symmetric encryption at the storage layer.
• Password security: Player passwords are never stored in plaintext. 12bank uses a one-way cryptographic hashing algorithm with per-user salt to store password credentials.
• Access controls: Access to personal data within the 12bank team is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to confidentiality agreements and undergo regular data protection training.
• Two-factor authentication: 12bank offers and encourages two-factor authentication (2FA) for all player accounts. Players who enable 2FA are required to verify their identity via a one-time code at each login.
• Intrusion detection: 12bank operates automated intrusion detection systems that monitor for unusual access patterns, brute-force login attempts, and other indicators of account compromise.
• Incident response: In the event of a data security incident that poses a material risk to your privacy rights, 12bank will notify affected players without undue delay and will take immediate remediation action.

While 12bank takes all reasonable steps to protect your personal data, no digital platform can guarantee absolute security. You play an important role in account security by keeping your login credentials confidential and logging out of your account after each session, particularly when using shared or public devices.

As a player on the 12bank platform, you hold the following rights in respect of your personal data. These rights may be exercised at any time by contacting [email protected] with the subject line "Privacy Request" and your registered account details.

• Right of access: You may request a copy of the personal data 12bank holds about you, together with information about how it is being processed. 12bank will provide this within 30 calendar days of the request.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated. Identity data corrections may require supporting documentation to verify the change.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and consent was the lawful basis), or where you object to processing and there are no overriding legitimate grounds. This right is subject to our legal and regulatory retention obligations — we cannot delete KYC records within the mandatory retention period.
• Right to restriction: You may request that 12bank restricts active processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested or while an objection to legitimate interest processing is assessed.
• Right to object: You may object to processing based on legitimate interests at any time. 12bank will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an unconditional right to object to processing for direct marketing purposes.
• Right to data portability: Where processing is based on consent or contract performance and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

12bank will not charge a fee for reasonable data subject requests. Where requests are manifestly unfounded or excessive, 12bank reserves the right to charge a proportionate administrative fee or decline to act on the request, with written reasons provided to you.

12bank operates mandatory age verification checks as part of the account registration and KYC process. These checks are designed to prevent access by minors. If you are the parent or guardian of a minor and believe that your child has registered a 12bank account, please contact [email protected] immediately. We will investigate and take prompt action to close the account and return any funds deposited to the payment method of origin.

12bank recommends that parents and guardians of children who share household devices use parental control software to restrict access to online gambling platforms. We support industry-wide efforts to prevent underage gambling and cooperate fully with any investigation relating to potential access by minors.

12bank may send you promotional communications — including welcome bonuses, reload offers, seasonal promotions tied to events such as BPL cricket, Eid, Pohela Boishakh, and T20 World Cup fixtures, and general platform updates — via SMS to your registered mobile number or email to your registered email address.

Marketing communications are sent only where:

• You have explicitly opted in to receive them during registration or via your account settings, or
• You are an existing player and the communication relates to similar services to those you have previously used, and you have not opted out.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in the 12bank account settings dashboard, or
• Replying STOP to any SMS marketing message, or
• Contacting [email protected] with the subject line "Marketing Opt-Out" and your registered phone number or email address.

Please allow up to 5 business days for opt-out requests to take effect across all communication channels. Opting out of marketing communications does not affect transactional messages, which include deposit confirmations, withdrawal notifications, security alerts, and account verification requests. These operational messages are sent regardless of marketing preferences, as they are necessary for the delivery of the 12bank service.

Players who have activated a self-exclusion under the Responsible Gaming Policy will be automatically removed from all marketing lists for the full duration of the exclusion period, with no further action required on their part.

12bank reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. When material changes are made, we will notify active account holders via the contact details registered on their account at least 14 calendar days before the changes take effect. The revised policy will be published at 12bank.bio/privacy-policy with an updated effective date and version number.

Minor amendments — such as corrections of typographical errors, clarifications of existing provisions, or administrative updates — may be made without individual notification and will be indicated by an updated version number at the head of this document.

Continued use of the 12bank platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the changes, you must discontinue use of the platform and may request account closure by contacting [email protected].

For all privacy-related enquiries, data subject requests, complaints, or questions regarding this Privacy Policy, please contact the 12bank data protection team using the details below. All requests are handled confidentially and in accordance with the timelines specified in this policy.

If you are not satisfied with 12bank's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction or to seek independent legal advice.