Privacy Policy for a11111

a11111 collects personal data from players at different points during the account lifecycle. The categories of data we collect, and the context in which each is gathered, are described in the table below.

Players based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar are all subject to the same data collection and protection standards. a11111 does not apply different data practices based on a player's geographic location within Bangladesh.

The categories of third parties with whom a11111 may share your personal data, and the specific reason for each sharing relationship, are as follows:

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking partners receive the minimum financial data necessary to process your deposit or withdrawal transaction. These entities operate under their own privacy policies and are independently regulated financial service providers in Bangladesh.
• Game Studio Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and session data to facilitate game rounds. They do not receive your name, contact details, or payment information.
• Identity Verification Services: Third-party KYC verification partners may receive copies of your identity documents and personal details to confirm your identity and age on a11111's behalf. These partners are contractually bound to process your data only for this purpose.
• Platform Infrastructure Providers: Cloud hosting, database management, and content delivery network (CDN) providers that support a11111's technical operations may process data as part of their service delivery. All such providers are bound by data processing agreements that restrict how they handle a11111 player data.
• Fraud Prevention Services: Specialist fraud detection and anti-money-laundering screening tools may receive technical data (IP address, device fingerprint, transaction metadata) to assess risk. No sensitive personal data beyond what is strictly necessary for the risk assessment is shared.
• Legal and Regulatory Authorities: a11111 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by law, or where disclosure is necessary to protect the rights, property, or safety of a11111, its players, or the public.

In the event that a11111 undergoes a corporate restructuring, merger, or acquisition, player data may be transferred to the successor entity as part of that transaction. Players will be notified of any such transfer and the privacy protections applying to their data will remain in force.

a11111 retains personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to different categories of player data:

• Active Account Data (identity, contact, financial history): Retained for the full duration of the account relationship and for a minimum of 5 years following account closure, in line with standard financial record-keeping obligations.
• KYC Verification Documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction to support anti-money-laundering audit requirements.
• Support Communications: Retained for 2 years from the date of the most recent correspondence in a given support thread.
• Technical / Session Logs: Retained for up to 12 months for fraud investigation and platform security purposes, then deleted or anonymised.
• Marketing Opt-in Records: Retained for as long as you hold an active account and for 12 months following account closure as evidence of consent.

When a retention period expires, data is either securely deleted from a11111's systems or irreversibly anonymised so that it can no longer be linked to an individual player. Anonymised, aggregated data may be retained indefinitely for platform analytics and historical reporting purposes.

Players who request account deletion should be aware that a11111 is legally obligated to retain certain categories of data (particularly KYC documents and transaction records) for the minimum retention periods stated above, even where a deletion request is submitted. All other data that is not subject to a legal retention obligation will be deleted promptly upon a valid deletion request.

a11111 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to the following:

• Transport Layer Security: All data transmitted between your device and a11111 is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Database Encryption: Sensitive data fields — including identity documents, payment account references, and password hashes — are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within a11111's systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of access required to perform their role, and all access is logged and auditable.
• Password Security: Player passwords are stored as salted cryptographic hashes. a11111 staff cannot read or retrieve your password in plain text. If you forget your password, a reset link will be sent to your registered email address.
• Fraud Monitoring: a11111 operates continuous automated monitoring for suspicious login attempts, unusual account activity, and potential data security incidents. Detected anomalies trigger immediate alerts for human review.
• Penetration Testing: a11111's platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All personnel with access to player data receive mandatory data protection and security training as part of their onboarding and on an ongoing annual basis.

Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data security incident that poses a risk to your personal data, a11111 will notify affected players without undue delay and will take all reasonable steps to contain the incident and prevent recurrence.

Players also have a role in account security. We strongly recommend using a unique, strong password for your a11111 account, enabling any available two-step verification, and logging out of your account when using a shared or public device. If you suspect that your account has been accessed without your authorisation, contact [email protected] immediately.