qa9 Privacy Policy — Your Data, Explained

1. Data We Collect

When you register for a qa9 account, use the platform, or interact with our support team, we collect certain categories of personal data. The specific data collected depends on the nature of the interaction. We do not collect more data than is necessary for the purposes described in this Privacy Policy.

1.1 Registration Data

When you create a qa9 account, we collect the following information:

• Full legal name
• Date of birth (used for age verification — players must be 18 years or older)
• Residential address, including city and division within Bangladesh
• Email address
• Mobile phone number (used for account security and communications)
• Chosen username and encrypted password

1.2 KYC Verification Data

In compliance with our Know Your Customer (KYC) obligations, qa9 collects identity verification documents prior to processing a player's first withdrawal. These may include:

• A copy of a government-issued photo ID (National ID card, passport, or driving licence)
• Proof of residential address (utility bill, bank statement, or similar document dated within three months)
• Proof of payment method registration (e.g., a screenshot of your bKash or Nagad account confirming the registered mobile number matches the account holder)

1.3 Transaction Data

Every deposit, withdrawal, and wagering transaction on the qa9 platform generates a transaction record. This record includes the transaction type, amount in BDT, payment method used (e.g., bKash, Nagad, Rocket, Visa), timestamp in Bangladesh Standard Time (BST, UTC+6), and the outcome of any associated bet or game round. Transaction records are retained for the periods described in Section 5 of this policy.

1.4 Device and Technical Data

When you access qa9 through a browser or mobile device, our servers automatically record certain technical information. This includes your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and the pages and features you interact with during your session. This technical data is used to maintain platform security, detect fraudulent access patterns, and improve the qa9 user experience for players across Bangladesh.

1.5 Communications Data

When you contact qa9 support via email at [email protected] or through the platform's in-built messaging tools, we retain records of those communications. These records are used to resolve disputes, provide continuity of support, and improve the quality of our customer service operations.

2. How We Use Your Data

qa9 uses the personal data we collect only for legitimate, specified purposes. We do not process your data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which qa9 processes personal data are as follows:

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, contact details	Contractual necessity
Age verification and KYC compliance	Date of birth, KYC documents	Legal obligation
Processing deposits and withdrawals	Transaction data, payment method details	Contractual necessity
Fraud prevention and platform security	Device data, IP address, transaction data	Legitimate interest
Customer support and dispute resolution	Communications data, account history	Contractual necessity
Responsible gaming monitoring	Wagering history, session data, account behaviour	Legal obligation / legitimate interest
Promotional communications (opt-in)	Email address, mobile number, preferences	Consent
Platform performance and analytics	Device data, session data, usage patterns	Legitimate interest

Where qa9 relies on your consent to process data — for example, for sending promotional emails about new games, BPL cricket betting markets, or seasonal offers during Eid or Pohela Boishakh — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

3. Data Sharing & Third Parties

qa9 does not sell or rent personal data to third parties. We share your information only in the following limited and controlled circumstances:

3.1 Payment Service Providers

To process deposits and withdrawals, qa9 shares necessary transaction data with payment processors and mobile wallet operators including bKash, Nagad, Rocket, Upay, and bank partners such as Dutch-Bangla Bank and BRAC Bank. These providers receive only the data required to execute a specific transaction and are bound by their own privacy and security obligations.

3.2 Game Software Providers

qa9 integrates game content from third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game hosted by these providers, your player ID and session data may be transmitted to the provider's servers to enable the game to function. qa9 does not transmit your full name, address, or payment details to game providers.

3.3 Technology and Infrastructure Partners

qa9 uses third-party hosting, cloud infrastructure, and analytics services to operate the platform. These providers act as data processors under contract with qa9 and are prohibited from using your data for their own purposes. All such providers are required to implement appropriate technical and organisational security measures.

3.4 Legal and Regulatory Disclosure

qa9 may disclose personal data when required to do so by applicable law, court order, or lawful request from a competent government or regulatory authority. In such cases, qa9 will disclose only the minimum data necessary to satisfy the legal requirement and will, where permitted, notify the affected player of the disclosure.

4. Cookies & Tracking Technologies

qa9 uses cookies and similar tracking technologies to operate the platform, remember your session preferences, and analyse how players interact with different features. A cookie is a small text file stored on your device when you visit a website. Cookies do not contain executable code and cannot access other files on your device.

4.1 Types of Cookies Used

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cannot be disabled without disrupting platform functionality.
• Preference cookies: Store settings such as your language preference, preferred game categories, and display options so these are remembered on your next visit.
• Analytics cookies: Help qa9 understand how players navigate the platform — for example, which game categories attract the most engagement, where players drop off during the deposit flow, and which pages generate the most support requests. This data is aggregated and not linked to individual identities.
• Security cookies: Used to detect and prevent fraudulent login attempts, identify unusual account activity, and enforce responsible gaming session controls.

4.2 Managing Cookie Preferences

You can manage or disable non-essential cookies through your browser settings at any time. Instructions for managing cookies vary by browser; refer to your browser's help documentation for guidance. Please note that disabling essential cookies will prevent you from logging in to your qa9 account and accessing platform features. Disabling analytics or preference cookies will not affect your ability to deposit, play, or withdraw.

5. Data Retention

qa9 retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of the account relationship and for a minimum of five years following account closure, to satisfy anti-money laundering record-keeping requirements.
• KYC verification documents: Retained for a minimum of five years from the date of last account activity or account closure, whichever is later.
• Transaction records: Retained for a minimum of five years to support financial audit, dispute resolution, and regulatory reporting obligations.
• Support communications: Retained for three years from the date of the last communication, or longer if the communication is linked to an unresolved dispute or regulatory matter.
• Marketing preferences and consent records: Retained for three years from the date consent was given, updated, or withdrawn.
• Analytics and session data: Retained in aggregated form indefinitely; individual-level session data is anonymised or deleted after 24 months.

When the applicable retention period expires and no overriding legal obligation requires continued storage, qa9 will securely delete or anonymise the relevant data so that it can no longer be associated with an identifiable individual.

6. Your Privacy Rights

As a qa9 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact our support team at [email protected] with the subject line "Privacy Rights Request". We will respond within a reasonable timeframe and will ask you to verify your identity before actioning a request.

6.1 Right of Access

You have the right to obtain confirmation of whether qa9 holds personal data about you and, if so, to receive a copy of that data along with information about how it is used, where it came from, and with whom it has been shared.

6.2 Right to Rectification

If any personal data qa9 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Players may update certain profile details directly through the account dashboard; for changes to KYC-verified data, a rectification request must be submitted to the support team along with supporting documentation.

6.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. The right to erasure does not apply where qa9 is required to retain data to comply with a legal obligation — for example, the five-year retention requirement for KYC documents and transaction records.

6.4 Right to Restriction of Processing

In certain circumstances — for example, while a dispute about data accuracy is being resolved — you may request that qa9 restrict the processing of your personal data to storage only, without using it for any other purpose.

6.5 Right to Object to Marketing

You have the right to object to the processing of your personal data for direct marketing purposes at any time. Upon receiving an objection, qa9 will cease processing your data for marketing immediately. You can also unsubscribe from promotional emails by clicking the unsubscribe link in any marketing email sent by qa9.

7. Data Security Measures

qa9 applies a layered approach to data security, combining technical controls, operational procedures, and staff training to reduce the risk of unauthorised access, accidental loss, or unlawful processing of personal data.

7.1 Technical Controls

• Transport Layer Security (TLS): All connections to the qa9 platform are encrypted using TLS 1.2 or higher, protecting data in transit between your browser or mobile app and our servers.
• Data encryption at rest: Sensitive personal data fields, including identity document references and payment identifiers, are encrypted in qa9's databases using AES-256 encryption.
• Access controls: Access to production systems and player data is restricted to authorised personnel based on the principle of least privilege. Administrative access requires multi-factor authentication.
• Intrusion detection: qa9 uses automated monitoring systems to detect and alert on unusual access patterns, including repeated failed login attempts, anomalous withdrawal requests, and suspicious IP activity.

7.2 Incident Response

In the event of a personal data breach that poses a risk to player rights and freedoms, qa9 will take immediate steps to contain the breach, assess its scope, and notify affected players and relevant authorities as required. Players are encouraged to report any suspected security issue involving their qa9 account by contacting [email protected] immediately.

8. Contact & Privacy Requests

If you have any questions about this Privacy Policy, wish to exercise any of the rights described in Section 6, or wish to report a privacy concern, please contact the qa9 privacy team using the details below. All privacy correspondence should be directed to the support email address and clearly marked with the nature of the request.

Email: [email protected]
Subject line format: "Privacy Rights Request — [Your Request Type]"
Response time: Within 10 business days of receipt (Bangladesh Standard Time)

qa9 takes all privacy requests seriously. Where a request cannot be fulfilled in full — for example, because fulfilling it would conflict with a legal retention obligation — we will explain the reason in our response and tell you what action we have taken in relation to the parts of the request that can be fulfilled.

qa9 reserves the right to update this Privacy Policy at any time. Where changes are material, we will provide notice via email to registered players or through a prominent notification on the platform. The effective date at the top of this document will always reflect the date of the most recent revision. We encourage players to review this page periodically to stay informed about how qa9 protects their personal data.