ac678 Privacy
Policy

ac678 collects personal data in the following categories, depending on how you interact with the platform. All data collection is grounded in a lawful basis — either your consent, the performance of your membership contract, or our legitimate interest in fraud prevention and platform security.

Registration Data

When you create an ac678 account, we collect the information you provide directly: your full legal name, date of birth, mobile phone number registered in Bangladesh, and your chosen username. This information is used to establish your account identity and to comply with our Know Your Customer (KYC) obligations.

Identity Verification Documents

In accordance with our KYC process, we may request copies of government-issued identity documents such as your National Identity Card (NID), passport, or birth certificate, as well as proof of payment method ownership (for example, a screenshot confirming that your bKash or Nagad wallet is registered in your own name). These documents are used solely for identity verification and age confirmation purposes.

Financial & Transaction Data

We collect records of all deposits and withdrawals made through your ac678 account, including the payment method used (bKash, Nagad, Rocket, Upay, or bank transfer), the BDT amount, the date and time of the transaction, and the transaction reference number. We do not store full mobile banking PINs, OTP codes, or internet banking passwords — payment authentication is handled entirely by your mobile wallet provider.

Device & Technical Data

When you access ac678, our servers automatically collect certain technical information: your IP address, browser type and version, device type (mobile or desktop), operating system, screen resolution, referring URL, and pages visited within the platform. This data is collected via server logs and analytics tools and is used to maintain platform performance and detect suspicious activity.

Gameplay & Betting Activity

ac678 maintains records of your gameplay history — including slot sessions with Pragmatic Play, Evolution Gaming, and Spribe titles, as well as cricket and sports betting activity — for the purposes of account integrity, dispute resolution, responsible gaming monitoring, and bonus verification.

ac678 does not sell or rent your personal data to any third party. We share data with external parties only in the limited circumstances described below, and only to the minimum extent necessary to fulfil the stated purpose.

Payment Service Providers

To process your BDT deposits and withdrawals, ac678 shares relevant transaction data with your chosen mobile wallet provider (bKash, Nagad, Rocket, or Upay) or banking partner (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or Sonali Bank). These providers receive only the data required to authenticate and complete the transaction. They are bound by their own privacy policies and applicable Bangladeshi financial regulation.

Game Software Providers

To deliver our casino and slot games, ac678 works with licensed game studios including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. These providers receive an anonymised player session token to manage your game session. They do not receive your full name, NID details, or payment method information.

Fraud Prevention & KYC Partners

ac678 uses third-party fraud screening and KYC verification tools to verify player identities and detect suspicious transaction patterns. These tools may process your name, date of birth, and document images for verification purposes. All such partners are contractually required to process your data solely for the agreed purpose and to maintain appropriate security standards.

Legal & Regulatory Disclosure

ac678 may disclose personal data to law enforcement agencies, courts, or regulatory authorities in Bangladesh where we are legally compelled to do so by a valid court order, statutory obligation, or lawful request. In such cases, we will disclose the minimum data necessary and, where permitted by law, will notify the affected player.

ac678 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. The key measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and the ac678 platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all account pages, deposit flows, and withdrawal requests.
• Encrypted Data Storage: Sensitive personal data — including identity document images, financial records, and account credentials — is stored in encrypted form in our databases. Passwords are stored as salted cryptographic hashes and are never retrievable in plain text by any ac678 employee.
• Access Controls: Access to personal data within ac678's systems is restricted on a strict need-to-know basis. Staff members can only access the data categories necessary to perform their assigned role, and all access is logged and periodically audited.
• Two-Factor Authentication (2FA): ac678 offers 2FA for all player accounts. We strongly encourage all members — especially those in Dhaka and Chittagong with high-value accounts — to enable 2FA from their account security settings to add a critical additional layer of protection.
• Penetration Testing: ac678 commissions regular independent security assessments and penetration tests to identify and remediate vulnerabilities in the platform before they can be exploited.
• Incident Response: In the event of a data security incident that affects your personal data, ac678 will notify affected players without undue delay and will take immediate steps to contain and remediate the incident.

While ac678 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are encouraged to do your part by using a strong unique password, enabling 2FA, and never sharing your login credentials with anyone.

As an ac678 player, you hold meaningful rights over your personal data. These rights may be exercised at any time by contacting our support team at [email protected]. ac678 will acknowledge all data rights requests within 48 hours and will respond in full within 30 days.

• Right of Access: You may request a copy of all personal data that ac678 holds about you, together with information about how it is being processed. This includes your registration data, KYC documents, transaction history, and gameplay records.
• Right to Rectification: If any personal data held by ac678 is inaccurate or incomplete — for example, an incorrect date of birth or a misspelled name — you have the right to request that it be corrected promptly.
• Right to Erasure: You may request that ac678 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where you believe the data has been processed unlawfully. Note that erasure requests may be declined where retention is required by law (e.g., AML record-keeping obligations).
• Right to Restrict Processing: You may request that ac678 pause the processing of your personal data — for example, while a rectification request is being considered — without requiring full erasure of the data.
• Right to Object: You have the right to object at any time to ac678 processing your data for direct marketing purposes, including promotional SMS and email communications. Marketing opt-outs are processed immediately upon request.
• Right to Data Portability: You may request that ac678 provide your personal data in a structured, machine-readable format so that you can transfer it to another service provider of your choice.