8am Privacy Policy —
How We Collect, Use &
Protect Your Personal Data

1. Data Controller and Contact Information

8am operates as the data controller in respect of all personal data collected through the 8am platform, including its website and mobile-optimised interface. As data controller, 8am determines the purposes and means by which your personal data is processed.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data 8am holds about you, you may contact the 8am data privacy team using the following details:

• Platform name: 8am
• Website: https://8am.im
• Support contact: support at 8am.im (plain text — not a clickable link)
• Business hours: Monday to Sunday, 09:00 – 22:00 Bangladesh Standard Time (BST, UTC+6)

All privacy-related enquiries submitted via the official support channel will be acknowledged within 48 hours and addressed within 14 calendar days. Complex requests involving data export or erasure may take up to 30 calendar days from acknowledgement.

2. Personal Data We Collect

8am collects personal data through several channels: directly from you when you register and use the platform, automatically through technical systems as you interact with the platform, and from third-party service providers engaged by 8am to operate specific platform functions.

2.1 Data Provided Directly by You

When you register an account, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions, you may provide 8am with some or all of the following categories of personal data:

Data Category	Specific Data Points	Collection Trigger
Identity Data	Full legal name, date of birth, gender, nationality, NID number or passport number	Registration, KYC verification
Contact Data	Mobile phone number (11-digit BD format), email address, residential address (division, district, thana)	Registration, address verification
Document Data	Scanned copies of NID, passport, utility bill, or bank statement	KYC / identity verification
Financial Data	bKash / Nagad / Rocket account number (truncated), bank account name, transaction reference numbers	Deposit and withdrawal processing
Account Data	Username, hashed password, account preferences, communication preferences, self-exclusion settings	Registration, ongoing account use
Communication Data	Support chat transcripts, email correspondence with 8am, dispute records	Customer support interactions

2.2 Data Collected Automatically

When you access the 8am platform, our technical systems automatically collect certain data about your device and session. This technical data is used for platform security, fraud prevention, and improving the user experience:

• Device Information: Device type (mobile, tablet, desktop), operating system and version, browser type and version, screen resolution.
• Network Information: IP address, approximate geolocation derived from IP (country and city level), internet service provider name.
• Session Data: Login timestamp, session duration, pages and game sections visited, bet placement timestamps, in-session navigation path.
• Technical Logs: Error logs, API response codes, platform performance data collected for debugging and stability monitoring.

2.3 Data from Third-Party Service Providers

8am works with a number of third-party service providers to operate the platform. These providers may share limited personal data with 8am in the course of their service delivery:

• Payment processors (bKash, Nagad, Rocket, Upay, and partner banks) share transaction confirmation data, including transaction reference numbers and timestamps, to allow 8am to verify and reconcile deposits and withdrawals.
• Game studios (including Pragmatic Play, Evolution Gaming, Spribe, and Ezugi) share game session outcome data and RNG certification data to enable fair-play auditing and dispute resolution.
• Identity verification services used during KYC processing may share verification status results with 8am to confirm document authenticity.

3. Legal Basis for Processing

8am processes your personal data only where there is a lawful basis for doing so. The following legal bases apply to 8am's data processing activities:

• Contractual necessity: Processing that is necessary to perform the contract between you and 8am — including registering your account, processing deposits and withdrawals, providing access to betting markets and casino games, and communicating with you about your account. Without this processing, 8am cannot provide the services you have contracted for.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) obligations, record-keeping requirements, and mandatory responses to lawful requests from authorities.
• Legitimate interests: Processing conducted on the basis of 8am's legitimate business interests, where those interests are not overridden by your rights and interests. This includes fraud prevention, platform security, abuse detection, and improving the platform's features and performance.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in connection with the sending of promotional communications and the use of non-essential cookies. You may withdraw consent for consent-based processing at any time by updating your account communication preferences or contacting support.

4. How We Use Your Personal Data

8am uses the personal data described in Section 2 for the following specific purposes. Each purpose is matched to the legal basis described in Section 3:

4.1 Account Registration and Management

Identity, contact, and account data are used to create and manage your 8am account, authenticate your login sessions, enable password recovery, and communicate with you about account activity. This processing is necessary for the performance of the service contract.

4.2 Identity Verification (KYC)

Document and identity data are used to verify that you are who you claim to be, that you meet the minimum age requirement of 18 years, and that your payment methods are registered in your own name. KYC processing is both a contractual requirement (necessary to enable withdrawals) and a legal obligation under applicable anti-money laundering standards.

4.3 Payment Processing

Financial data is used to process your deposit and withdrawal requests via bKash, Nagad, Rocket, Upay, and partner banks, to reconcile transaction records, and to investigate payment disputes. This processing is necessary for performance of the service contract and, in part, for compliance with financial record-keeping obligations.

4.4 Responsible Gaming

Account activity data — including session frequency, session duration, deposit frequency, and betting patterns — is monitored by 8am's responsible gaming systems to detect signs of problematic gambling behaviour. Where concerning patterns are detected, 8am may trigger automatic responsible gaming notifications or interventions. This processing is based on 8am's legitimate interest in promoting safe gambling and protecting vulnerable players.

4.5 Fraud Prevention and Platform Security

Technical, session, and financial data are used to detect and prevent fraudulent activity, bonus abuse, multi-accounting, money laundering, and unauthorised access attempts. Security processing is based on 8am's legitimate interests in protecting the platform and its players from financial crime and abuse.

4.6 Customer Support

Communication data from your support interactions is used to handle your enquiries, investigate complaints, resolve disputes, and improve the quality of 8am's customer service. Support records are retained for the periods described in Section 7.

4.7 Marketing and Promotional Communications

Where you have consented to receive marketing communications, 8am may use your contact data to send you information about promotions, bonus offers, new game launches, and seasonal offers relevant to your interests — such as BPL match-day bonuses, Eid promotions, and IPL season offers. You may opt out of marketing communications at any time by updating your preferences in your account dashboard or by contacting support.

4.8 Platform Analytics and Improvement

Aggregated and anonymised session and usage data is analysed to understand how players interact with the platform, which features are most used, where usability improvements can be made, and how platform performance can be optimised. Analytics processing uses anonymised data and does not profile individual players for commercial purposes beyond improving the platform experience.

5. Data Sharing and Third-Party Disclosure

8am does not sell your personal data to any third party. 8am shares personal data only in the specific circumstances described below, and only to the extent necessary for each purpose:

5.1 Service Providers Acting as Data Processors

8am engages third-party service providers to perform specific functions on 8am's behalf. These providers process personal data only under 8am's instructions and are contractually bound to apply appropriate data protection standards. Categories of data processors engaged by 8am include payment service providers (bKash, Nagad, Rocket, Upay), identity verification services, cloud hosting and infrastructure providers, game studio integrations (Pragmatic Play, Evolution Gaming, Spribe, Ezugi), and customer support platform operators.

5.2 Legal and Regulatory Disclosure

8am may disclose personal data to relevant authorities, law enforcement agencies, courts, or regulators where required by applicable law, where necessary to comply with a valid legal process, or where disclosure is necessary to prevent or detect serious crime including fraud or money laundering. 8am will disclose only the minimum data necessary to fulfil the legal obligation and will notify affected players of any disclosure to the extent permitted by law.

5.3 Business Transfers

In the event that 8am undergoes a merger, acquisition, restructuring, or sale of assets, personal data held about registered players may be transferred to the acquiring entity as part of that transaction. In such circumstances, the acquiring entity will be required to honour the commitments made in this Privacy Policy or notify players of any material change to the applicable privacy terms prior to the transfer taking effect.

5.4 Protection of 8am's Rights

8am may disclose personal data where necessary to enforce these Terms, to investigate suspected breaches of the Terms or this Policy, to protect the rights, property, or safety of 8am, its players, or third parties, or to defend against legal claims brought against 8am.

6. Cookies and Tracking Technologies

8am uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your logged-in session, prevent fraud, and — where you have consented — to deliver relevant promotional content. This section explains what cookies 8am uses and how you can manage them.

6.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit the 8am platform. They allow the platform to recognise your device across page requests within a session (session cookies) or across multiple visits (persistent cookies). Cookies do not contain executable code and cannot access other files on your device.

6.2 Categories of Cookies Used by 8am

Cookie Category	Purpose	Consent Required?
Strictly Necessary	Maintain login sessions, enable secure account access, prevent cross-site request forgery, remember language/currency preferences	No — essential to platform operation
Functional	Remember your preferred game lobby view, deposit method, responsible gaming settings, and notification preferences	No — operational functionality
Analytics	Collect anonymised data on page visits, feature usage, session duration, and navigation paths to improve platform performance	Yes — consent-based
Marketing / Retargeting	Serve relevant promotional content based on your activity on the 8am platform	Yes — consent-based

6.3 Managing Your Cookie Preferences

You may withdraw consent for non-essential cookies at any time by updating your browser settings to block or delete cookies, or by adjusting your communication and tracking preferences within your 8am account dashboard. Note that disabling strictly necessary cookies will impair your ability to log in and use the platform. 8am's cookie preferences centre, accessible from the account settings page, provides granular controls for each cookie category.

7. Data Retention Periods

8am retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, after which it is securely deleted or irreversibly anonymised. The following retention periods apply to the main categories of personal data:

Data Category	Retention Period	Basis
Account and identity data (active accounts)	Duration of account + 5 years after closure	Legal obligation (AML record-keeping)
KYC documents	5 years from account closure or last transaction	Legal obligation (identity verification compliance)
Financial transaction records	7 years from transaction date	Legal obligation (financial record-keeping)
Betting and game history	3 years from transaction date	Contractual — dispute resolution
Customer support correspondence	3 years from last interaction	Legitimate interest — dispute resolution
Marketing preferences and consent records	Duration of consent + 2 years after withdrawal	Legal obligation — proof of consent
Analytics data (anonymised)	26 months from collection	Legitimate interest — platform improvement
Self-exclusion records	7 years from exclusion end date	Legal obligation and responsible gaming duty of care

When a retention period expires, 8am will securely delete or anonymise the relevant personal data using industry-standard data destruction procedures. Where anonymisation is used, the resulting data no longer constitutes personal data and may be retained indefinitely for aggregate analytical purposes.

8. Your Rights Over Your Personal Data

As a registered player on 8am, you hold the following rights in respect of your personal data. To exercise any of these rights, contact 8am's support team at the address listed in Section 1. All requests will be processed within 30 calendar days and at no charge to you, unless a request is manifestly unfounded, excessive, or repetitive.

8.1 Right of Access

You have the right to request confirmation of whether 8am processes personal data about you, and if so, to receive a copy of that data along with information about how it is used, where it is stored, and with whom it is shared. This is commonly referred to as a Subject Access Request (SAR).

8.2 Right to Rectification

If any personal data held by 8am about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented without undue delay. Certain data corrections (such as name changes or date of birth corrections) will require submission of supporting documentary evidence before the correction is applied.

8.3 Right to Erasure

You have the right to request that 8am delete your personal data in circumstances where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where processing is unlawful. This right is subject to override by legal retention obligations — 8am cannot erase financial transaction records or KYC documents during their mandatory retention periods even upon request.

8.4 Right to Restriction of Processing

You have the right to request that 8am restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing and a determination is pending. Restriction means that 8am may store the data but may not actively process it during the restriction period.

8.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON). You may also request that this data be transmitted directly to another platform where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data where that processing is based on 8am's legitimate interests. Where you object, 8am will cease processing unless compelling legitimate grounds for the processing exist that override your rights, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

8.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You may withdraw consent for marketing communications via your account dashboard. You may withdraw consent for non-essential cookies via the cookie preference centre in your account settings.

9. Data Security Measures

8am implements a multi-layered security architecture to protect personal data against unauthorised access, accidental loss, alteration, or destruction. Our technical and organisational security measures include:

• SSL/TLS Encryption: All data in transit between your device and 8am's platform is encrypted using current TLS standards. This applies to all page requests, form submissions, and API communications.
• Data Encryption at Rest: Sensitive personal data including KYC documents, financial references, and account credentials is encrypted at rest using AES-256 or equivalent encryption standards.
• Password Hashing: Account passwords are never stored in plain text. 8am uses industry-standard cryptographic hashing algorithms with per-account salting to ensure that even in the unlikely event of a data breach, passwords cannot be reverse-engineered.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff access to player data is logged, monitored, and subject to regular review. No employee may access player data for any purpose other than their authorised job function.
• Regular Security Testing: 8am conducts regular penetration testing, vulnerability scanning, and security audits of its platform infrastructure to identify and remediate security risks before they can be exploited.
• Fraud Monitoring Systems: Automated systems monitor all account activity in real time for patterns consistent with account takeover, credential stuffing, bonus abuse, and financial fraud. Suspicious activity triggers automatic protective measures including session termination and account review flags.
• Data Breach Response: In the event of a data breach that poses a risk to the rights and freedoms of registered players, 8am will assess the breach, take immediate containment measures, and notify affected players as soon as reasonably practicable, with details of what data was affected, what 8am has done in response, and what steps affected players should take to protect themselves.

Despite these measures, no platform can guarantee absolute security against all possible threats. You are encouraged to use a strong, unique password for your 8am account, to enable two-factor authentication where available, and to contact 8am support immediately if you suspect that your account has been compromised.

10. Children's Privacy

8am is strictly an adult platform. The minimum age to register an account and use the platform is 18 years. 8am does not knowingly collect, store, or process personal data belonging to persons under the age of 18.

If you are a parent or guardian and you believe that a person under 18 has registered an account on 8am or provided personal data to 8am, please contact 8am's support team immediately at the email address listed in Section 1. Upon receiving a verified report, 8am will:

• Immediately suspend the account in question;
• Conduct an expedited identity and age verification review;
• If confirmed as a minor's account, permanently close the account and delete or anonymise all associated personal data to the extent not prohibited by legal retention requirements;
• Return any deposits made to the original payment source after identity of the payment account holder is verified;
• Forfeiting all winnings, consistent with the Terms & Conditions applicable to underage accounts.

8am employs age verification as part of its standard KYC process and does not process withdrawal requests for any account that has not completed age verification. These controls together represent 8am's primary defence against underage access to the platform.

11. Updates to This Privacy Policy

8am reserves the right to update or amend this Privacy Policy at any time. When material changes are made — for example, changes to the categories of data collected, the purposes for which data is used, the third parties with whom data is shared, or the rights available to players — 8am will publish the updated Policy on this page and update the "Last Updated" date at the top of the document.

For material changes, 8am will provide at least 7 days' advance notice to registered players via the email address associated with their account before the updated Policy takes effect. Changes required by law or regulation may take effect immediately without advance notice.

Your continued use of the 8am platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with a material change to this Policy, you should stop using the platform and request account closure before the effective date of the change. Your account balance will be returned to you subject to KYC verification and applicable Terms.

The archived versions of previous Privacy Policy versions are available upon request by contacting 8am support. This allows players to review any changes made over time and understand how the treatment of their personal data has evolved.