qqaa Privacy Policy — How We Protect Your Personal Data

This Privacy Policy ("Policy") describes how qqaa ("qqaa", "We", "Us", "Our") collects, processes, stores, shares and protects personal data relating to individuals ("Player", "User", "You") who access or use the qqaa online platform available at qqaa.io, including all associated services, games, payment functions and customer support channels (the "Platform").

qqaa is committed to protecting the privacy and security of every Player's personal information. We process personal data only for clearly defined, legitimate purposes, and we apply appropriate technical and organisational safeguards to keep your data secure at all times.

By creating an account on the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, both of which form part of your overall agreement with qqaa.

qqaa acts as the data controller in respect of all personal data collected and processed through the Platform. As data controller, qqaa determines the purposes for which and the means by which personal data is processed.

All data-related enquiries, access requests, correction requests, deletion requests and complaints should be directed to the qqaa data protection contact at the email address published on this site: [email protected] (plain text — not a clickable link). qqaa aims to respond to all data-related communications within 30 calendar days of receipt.

qqaa collects the following categories of personal data from Players. We collect only the data that is necessary for the specific purpose for which it is being processed — a principle known as data minimisation.

qqaa does not intentionally collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data or health data) unless specifically required to fulfil a legal obligation (for example, processing a self-exclusion request that references a gambling-related health concern). Where sensitive data is collected for such purposes, it is treated with enhanced levels of protection.

qqaa collects personal data through the following methods:

• Direct collection: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to a survey or promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, pixel tags, server logs and similar technologies. See Section 10 (Cookies) for full details.
• Third-party sources: Identity verification and fraud-screening data from KYC service providers; payment confirmation data from payment processors including bKash, Nagad, Rocket, Upay and banking partners; geolocation data from IP intelligence services used for security and fraud prevention.
• Game providers: Gaming activity data relayed from third-party game studio platforms (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) in connection with the games you play on the Platform.

qqaa uses your personal data for the following specific purposes. We will not use your data for any purpose that is incompatible with those listed below without first obtaining your consent or establishing a separate lawful basis for the new processing activity.

• Account creation and management: To register your account, verify your identity and age, and maintain your account throughout its active lifecycle.
• Game and betting services: To provide the casino games, sports betting markets and other features available on the Platform; to record your gaming activity; and to administer your in-game transactions.
• Payment processing: To process deposits and withdrawals via your chosen payment methods and to reconcile transaction records.
• KYC and AML compliance: To fulfil legal obligations relating to Know Your Customer (KYC) verification, anti-money laundering (AML) screening, source-of-funds checks and fraud prevention.
• Responsible gaming: To monitor gaming activity for signs of problem gambling, to administer responsible gaming tools (deposit limits, self-exclusion, cooling-off periods), and to contact Players who may require support.
• Customer support: To respond to your enquiries, resolve disputes and administer complaints.
• Security and fraud prevention: To detect, investigate and prevent fraudulent transactions, unauthorised account access, bonus abuse and other prohibited conduct.
• Platform improvement: To analyse usage patterns and game performance data in order to improve the Platform's features, reliability and user experience.
• Marketing communications: To send you promotional communications about qqaa bonuses, tournaments and seasonal offers, where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time by contacting our support team.
• Legal compliance: To comply with applicable laws, regulations, court orders and regulatory requirements.

qqaa processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our contract with you — specifically, to operate your qqaa account, provide gaming services, process payments and administer bonuses.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC verification, AML screening, record-keeping obligations and responses to lawful requests from regulatory authorities or law enforcement bodies.
• Legitimate interests: Processing carried out for qqaa's legitimate business interests where those interests are not overridden by your data protection rights, including fraud prevention, Platform security, analytics, dispute resolution and direct marketing to existing Players.
• Consent: Processing based on your freely given, specific and informed consent — for example, the sending of marketing communications where no prior contractual relationship exists, or the collection of sensitive personal data in connection with responsible gaming support. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

qqaa does not sell your personal data. We share personal data with third parties only where strictly necessary and only for the specific purposes set out in this Policy. The categories of third parties with whom we may share data are as follows:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, Mastercard — to process your deposit and withdrawal transactions.
• KYC and identity verification providers: Third-party services engaged to verify your identity documents, perform age verification and conduct AML screening checks.
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi and other licensed game studios — to deliver game content and record gaming activity.
• Analytics providers: Anonymised or pseudonymised usage data may be shared with analytics platforms to help us understand Platform performance and user behaviour. No personally identifiable information is shared for analytics purposes.
• Legal and regulatory bodies: Where required by law, court order or regulatory directive, qqaa may disclose personal data to law enforcement agencies, financial intelligence units or other competent regulatory authorities.
• Professional advisers: Legal counsel, auditors and financial advisers engaged by qqaa on a confidential basis, where disclosure is necessary in connection with legal proceedings, audits or regulatory compliance.

All third-party data processors engaged by qqaa are required to process personal data only on qqaa's documented instructions, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection obligations. qqaa does not permit third-party processors to use Player data for their own independent purposes.

qqaa retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention guidelines apply:

• Active account data: Retained for the full duration of your account's active status plus a minimum period of five (5) years following account closure, to meet AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later, in accordance with financial crime prevention requirements.
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last communication, or until any associated dispute is fully resolved.
• Marketing consent records: Retained for as long as the consent remains active, plus three (3) years following withdrawal of consent or account closure.
• Technical and usage data: Typically retained in identifiable form for no longer than thirteen (13) months, after which it is anonymised or deleted.

Where retention beyond these standard periods is required by a legal hold, regulatory investigation or ongoing dispute, qqaa will retain the relevant data until the matter is fully resolved, after which the data will be securely deleted in accordance with qqaa's data destruction procedures.

qqaa employs a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the qqaa Platform, ensuring that your credentials, payment details and personal information cannot be intercepted in transit.
• Encrypted data storage for all databases containing personal and financial data, using AES-256 encryption at rest.
• Access controls: Role-based access control (RBAC) limiting qqaa staff access to personal data strictly on a need-to-know basis. All internal access to sensitive data is logged and audited.
• Two-factor authentication (2FA) available to all Players as an additional layer of account security, and mandatory for all internal staff accessing production systems.
• Intrusion detection and prevention systems (IDPS) monitoring Platform infrastructure for suspicious activity in real time.
• Regular security assessments including vulnerability scanning and penetration testing of the Platform's infrastructure and application stack.
• Incident response procedures: A documented data breach response plan that requires qqaa to assess, contain and notify affected Players of any data breach that is likely to result in a high risk to their rights and freedoms, within a reasonable timeframe.

qqaa uses cookies and similar tracking technologies (collectively, "Cookies") on the Platform to ensure its proper functioning, to gather analytics data and to deliver a personalised experience. A cookie is a small text file placed on your device when you visit a website.

The following categories of Cookies are used on the qqaa Platform:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session management cookies, authentication tokens and security cookies. These cookies cannot be disabled without severely impairing the Platform's functionality.
• Performance and analytics cookies: Used to collect anonymised or pseudonymised information about how Players use the Platform — for example, which pages are visited most frequently and whether error messages are received. This data is used solely to improve Platform performance.
• Functionality cookies: Used to remember your preferences (such as language and display settings) to provide a more personalised experience on return visits.
• Marketing and targeting cookies: Used to track your browsing activity across the Platform in order to display relevant promotional content. These cookies are only placed where you have provided prior consent.

You can control the use of non-essential cookies through your browser settings. Most browsers allow you to refuse all cookies, accept only certain types of cookies, or delete cookies already stored on your device. Please note that disabling certain categories of cookies may affect the functionality of parts of the Platform.

Subject to applicable law, you hold the following rights in relation to your personal data processed by qqaa. To exercise any of these rights, please contact our support team at [email protected]. qqaa will respond to all verified requests within 30 calendar days.

• Right of access: You have the right to request a copy of the personal data that qqaa holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data held by qqaa. Where possible, you may update certain data directly through your account profile settings.
• Right to erasure ("right to be forgotten"): You have the right to request the deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. Note that qqaa may be required to retain certain data to comply with legal obligations (e.g., AML record-keeping requirements) even following an erasure request.
• Right to restriction of processing: You have the right to request that qqaa restricts the processing of your personal data in certain circumstances, for example while the accuracy of the data is being disputed.
• Right to data portability: Where processing is based on your consent or on a contract with you, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
• Right to object: You have the right to object to processing based on qqaa's legitimate interests, including direct marketing. Where you object to direct marketing, qqaa will cease processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

In order to deliver the Platform's services, qqaa may transfer your personal data to, and process it in, countries outside Bangladesh. This may occur where qqaa's technology infrastructure, third-party game providers or KYC service providers are hosted or operate in a different jurisdiction.

Where such transfers occur, qqaa takes steps to ensure that your personal data remains subject to an equivalent level of protection. These steps may include:

• Entering into data processing agreements with third-party processors that incorporate standard contractual clauses providing appropriate safeguards for personal data transferred across borders.
• Assessing the data protection laws of the destination country and implementing supplementary technical measures where necessary to maintain the security and integrity of the transferred data.
• Transferring data only to jurisdictions that maintain adequate data protection frameworks.

By using the Platform, you acknowledge and consent to the transfer of your personal data to other countries as described in this section, subject to the safeguards outlined above.

The qqaa Platform is strictly intended for persons aged 21 years and above. qqaa does not knowingly collect or process personal data from individuals under the age of 21. Age verification checks are applied during the registration process to enforce this requirement.

If qqaa becomes aware that personal data has been collected from a person under the age of 21, qqaa will immediately close the associated account, delete all personal data relating to that individual, and return any funds to the payment source where this can be done lawfully. Any winnings accrued by an underage account will be forfeited.

If you are a parent or guardian and believe that a person under the age of 21 in your care has registered an account on the Platform, please contact us immediately at [email protected] (plain text — not a clickable link). We will act promptly to investigate and take appropriate action.

qqaa reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations or Platform features. The date of the most recent revision is indicated at the top of this document.

Where changes are material — for example, where we introduce a new category of data processing or a new type of data sharing — qqaa will notify registered Players via email or in-platform notification prior to the changes taking effect. For minor or administrative amendments, updating the Policy on this page with a revised effective date will constitute sufficient notice.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and request account closure. qqaa encourages you to review this Policy periodically.

If you have any questions, concerns or requests relating to this Privacy Policy or to qqaa's personal data processing practices, please contact our support team. All privacy-related communications should be addressed to:

qqaa Data Protection Contact
Email: [email protected] (plain text — not a clickable link)

qqaa will acknowledge receipt of all privacy-related enquiries within 5 business days and aims to provide a substantive response within 30 calendar days. For complex requests involving data access, erasure or portability, the response period may be extended by a further 30 days where necessary, in which case qqaa will inform you of the extension and the reasons for it.