su77 Privacy Policy — How We Handle Your Personal Data
su77 is committed to protecting the privacy and security of every player's personal information. This Privacy Policy explains in plain terms what data we collect, why we collect it, how we use it, who we share it with, and the rights you hold over your own information as a su77 account holder.
Six Ways su77 Protects Your Data
Before reading the full policy, here are the six core principles that govern how su77 handles every piece of personal information entrusted to us by players across Bangladesh.
Data Minimisation
su77 collects only the personal data that is strictly necessary to operate your account, process payments, verify your identity and comply with applicable legal obligations. We do not harvest data beyond what is needed and we do not sell your personal information to third parties.
SSL Encryption at All Times
Every connection between your device and the su77 platform is secured using industry-standard SSL/TLS encryption. Your login credentials, payment details and personal information are transmitted in encrypted form at all times, preventing interception or unauthorised access during transit.
No Data Sales to Third Parties
su77 does not sell, rent, lease or otherwise trade your personal data to any external marketing company, data broker, advertiser or unaffiliated third party. Data sharing with external parties is limited to the specific, necessary circumstances described in this Privacy Policy — and nothing more.
Your Right to Access & Correct
You have the right to request a copy of the personal data su77 holds about you at any time. If any of your data is inaccurate or out of date, you have the right to request a correction. Contact su77 support at [email protected] and we will respond within five business days.
Right to Erasure
Subject to our legal retention obligations — which require us to retain certain financial and identity records for a minimum period — you may request the deletion of your personal data. su77 will action verified erasure requests promptly and confirm completion in writing via your registered email address.
Marketing Opt-Out
All su77 marketing communications — including promotional emails, SMS notifications and bonus alerts — are opt-in only. You may withdraw your marketing consent and opt out of all promotional communications at any time through your account settings or by contacting su77 support. Opting out does not affect your account standing or access to games.
1 Definitions
Throughout this Privacy Policy, the following terms carry the meanings set out below:
- "su77", "we", "us" or "our" refers to the operator of the su77 platform accessible at su77.io and all associated services, games, betting markets and account functions.
- "Player", "you" or "your" refers to any individual who visits, registers an account on, or otherwise uses any part of the su77 platform.
- "Personal Data" refers to any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, email address, mobile number, device identifiers and payment method details.
- "Processing" refers to any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, erasure or destruction.
- "Third Party" refers to any organisation or individual that is not su77 and not the player to whom this policy applies.
- "KYC" refers to Know Your Customer procedures, encompassing identity verification and age verification processes applied to player accounts.
2 Data Controller
su77 acts as the data controller in respect of all Personal Data collected from players who use the su77 platform. As data controller, su77 determines the purposes for which and the means by which your Personal Data is processed. All data controller responsibilities under this Privacy Policy are discharged by su77 in accordance with applicable data protection principles.
If you have any question about how su77 processes your Personal Data, or if you wish to exercise any of the rights described in Section 10 of this policy, please contact the su77 data protection team at [email protected]. Contact details are provided in plain text only and are not clickable links.
3 Personal Data We Collect
3.1 Registration Data
When you create a su77 account, we collect the information you provide directly, including your full legal name, date of birth, email address, mobile telephone number, and the country and city of your residence (for example, Dhaka, Chittagong, Sylhet, Khulna or elsewhere in Bangladesh). This information is required to create and administer your account and to verify that you meet the minimum age requirement of 21 years.
3.2 Identity Verification (KYC) Data
To comply with our anti-money-laundering and responsible gaming obligations, su77 may request identity documents including a copy of your National Identity Card (NID), passport, driving licence or other government-issued photo identification. We may also request proof of address and, in certain circumstances, documentation relating to the source of funds used for deposits.
3.3 Transaction and Payment Data
su77 records all financial transactions associated with your account, including deposit amounts and timestamps, withdrawal requests and their outcomes, bonus credits and wagering activity. Payment method identifiers — such as the bKash or Nagad wallet number used for a transaction, or the last four digits and expiry date of a Visa or Mastercard — are retained for transaction reconciliation and fraud prevention purposes. su77 does not store full card numbers and does not have access to your mobile banking PINs or passwords.
3.4 Technical and Device Data
When you access the su77 platform, our systems automatically collect certain technical information about your device and connection. This includes your IP address, browser type and version, operating system, device type (mobile, tablet or desktop), screen resolution, referring URL, and session duration. This data is used to optimise platform performance, detect fraud, enforce responsible gaming controls (such as identifying duplicate accounts by shared IP or device fingerprint), and improve the overall player experience.
3.5 Behavioural and Usage Data
su77 collects data about how you use the platform — including which games you play, how long each session lasts, which bet types you place, which promotions you view or claim, and how you navigate between pages. This behavioural data is used to personalise your experience, to identify responsible gaming risk signals, and to improve our product and promotional offering. It is never sold to external parties.
3.6 Communications Data
If you contact su77 via live chat, email or telephone, we retain a record of that communication including the content of the exchange, the date and time, and any support ticket reference number. This allows us to provide consistent support, resolve disputes and improve our customer service operations.
The categories of Personal Data su77 collects, together with their primary purpose and retention period, are summarised in the table below:
| Data Category | Primary Purpose | Retention Period |
|---|---|---|
| Registration & identity data | Account creation, KYC, age verification | Duration of account + 5 years post-closure |
| KYC documents | AML compliance, identity verification | Duration of account + 5 years post-closure |
| Transaction & payment data | Payment processing, fraud prevention, financial records | 7 years from transaction date |
| Technical & device data | Platform security, fraud detection, duplicate account checks | 13 months from collection |
| Behavioural & usage data | Product improvement, responsible gaming monitoring | 13 months from collection |
| Support communications | Customer service, dispute resolution | 3 years from last contact |
4 How We Use Your Personal Data
su77 uses your Personal Data only for legitimate, defined purposes. The primary uses of the data we collect are as follows:
- Account administration: Creating, maintaining, verifying and managing your su77 player account, including processing deposits and withdrawals, applying bonuses and keeping accurate financial records.
- Identity and age verification: Confirming that you are who you say you are and that you are at least 21 years old, in compliance with responsible gaming obligations.
- Payment processing: Facilitating secure deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa and Mastercard in Bangladeshi Taka (BDT).
- Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, money laundering, duplicate accounts, bonus abuse, and other prohibited conduct as described in the su77 Terms & Conditions.
- Responsible gaming: Monitoring player behaviour for signs of problem gambling, applying player-requested limits and exclusions, and fulfilling our duty of care obligations.
- Legal compliance: Meeting our obligations under applicable laws including anti-money-laundering regulations, record-keeping requirements and court or regulatory orders where applicable.
- Platform improvement: Analysing aggregated, anonymised usage data to improve the su77 product, fix technical issues, and develop new features and games.
- Marketing communications (opt-in only): Sending promotional emails, SMS notifications and bonus offers to players who have provided explicit marketing consent. You may withdraw this consent at any time.
5 Legal Basis for Processing
su77 processes your Personal Data on the following legal bases depending on the purpose of the processing activity:
- Contractual necessity: Processing required to deliver the services set out in the su77 Terms & Conditions — including account creation, payment processing and game access — is performed on the basis that it is necessary for the performance of the contract between su77 and the player.
- Legal obligation: Processing carried out to comply with applicable laws — including KYC identity checks, AML transaction monitoring and financial record-keeping — is performed on the basis of su77's legal obligations.
- Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring and product improvement is carried out on the basis of su77's legitimate business interests, subject always to your rights and freedoms not being overridden.
- Consent: Processing for direct marketing communications is carried out only where you have provided your explicit, freely given, specific and informed consent. You may withdraw this consent at any time without affecting the legality of processing carried out before withdrawal.
6 Data Sharing with Third Parties
su77 does not sell your Personal Data to any third party. We share your data only in the specific circumstances described below, and only to the extent necessary for the stated purpose:
6.1 Payment Service Providers
To process your deposits and withdrawals, su77 shares necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, and card processing partners for Visa and Mastercard. These providers process your payment data only in accordance with their own published privacy policies and applicable financial services regulations.
6.2 Game Software Providers
The casino games available on su77 are powered by third-party software providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi. These providers receive limited technical session data — such as an anonymised session token and bet amount — necessary to deliver the game. They do not receive your name, email address or payment details.
6.3 Identity Verification Services
To fulfil our KYC obligations, su77 may use third-party identity verification service providers to assist in validating the authenticity of identity documents submitted by players. These providers are contractually bound to process identity data solely for verification purposes and to delete it promptly once verification is complete.
6.4 Legal and Regulatory Disclosures
su77 may disclose Personal Data to law enforcement agencies, regulatory bodies, courts or other public authorities where required to do so by applicable law, court order, or where su77 has a good-faith belief that disclosure is necessary to prevent fraud, protect the safety of any person, or protect su77's legal rights.
7 Cookies and Tracking Technologies
7.1 What Cookies su77 Uses
su77 uses cookies and similar tracking technologies — including local storage objects and session tokens — to operate the platform effectively and to improve the player experience. The categories of cookies su77 uses are as follows:
- Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit, security tokens, and load-balancing cookies. These cannot be disabled without breaking the platform.
- Functional cookies: Remember your preferences such as language setting, last-visited game category and responsible gaming limit values you have set. Disabling these may reduce your experience on the platform.
- Analytics cookies: Collect anonymised data about how players navigate the su77 platform, which pages are most visited, and where technical errors occur. This data is used exclusively to improve the platform and is not linked to your individual identity.
- Security and fraud-detection cookies: Used to identify unusual access patterns, detect bots and automated tools, and flag potential duplicate account activity. These are a core component of su77's security infrastructure.
7.2 Managing Cookies
You can control non-essential cookies through your browser settings. Blocking or deleting cookies may affect the functionality of the su77 platform. Instructions for managing cookies are available in your browser's help documentation. Note that strictly necessary and security cookies cannot be disabled without preventing core platform functions from operating correctly.
8 Data Retention
su77 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The specific retention periods for each category of Personal Data are set out in the table in Section 3 of this policy.
When a player account is closed — whether at the player's request or due to a breach of the su77 Terms & Conditions — su77 will retain identity, KYC and financial transaction records for a minimum of five years from the date of account closure. This retention period reflects anti-money-laundering and financial record-keeping obligations. Behavioural and device data that is not required for legal compliance purposes will be deleted or anonymised within 13 months of collection.
Where you have self-excluded from su77, we retain a record of your self-exclusion indefinitely to prevent re-registration during or after the exclusion period. This is a responsible gaming safeguard, not a commercial data retention practice.
9 Data Security
su77 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration or destruction. These measures include:
- SSL/TLS encryption for all data in transit between your device and su77's servers.
- Encryption of sensitive data at rest, including stored KYC documents and payment method identifiers.
- Access controls ensuring that only authorised su77 personnel with a specific operational need can access player Personal Data.
- Regular security audits and penetration testing of the su77 platform infrastructure.
- Intrusion detection systems and 24/7 security monitoring of server infrastructure.
- Secure deletion protocols for data that has reached the end of its retention period.
Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected players, su77 will notify affected individuals promptly and will take all reasonable steps to contain and remediate the breach.
10 Your Privacy Rights
As a su77 player, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact su77 at [email protected] with the subject line "Privacy Rights Request":
- Right of access: You may request a copy of the Personal Data su77 holds about you. We will provide this in a structured, commonly used format within five business days.
- Right to rectification: If any of your Personal Data held by su77 is inaccurate or incomplete, you may request that we correct it. Updates to your registered email address, phone number or residential address can also be made through your account settings.
- Right to erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there is no overriding legitimate ground. Erasure requests may be declined where retention is required by law.
- Right to restrict processing: You may request that su77 restrict the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of su77's legitimate grounds.
- Right to data portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you may request that su77 provide your Personal Data in a machine-readable format suitable for transfer to another service provider.
- Right to object: You may object to the processing of your Personal Data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on legitimate interests, in which case su77 will assess whether its legitimate grounds override your rights.
- Right to withdraw consent: Where su77's processing of your data is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
11 Children's Privacy and the 21+ Rule
The su77 platform is strictly intended for adults aged 21 years and above. su77 does not knowingly collect Personal Data from any individual under the age of 21. If you are under 21, you must not use the su77 platform or provide any personal information to su77.
If su77 discovers or has reasonable grounds to believe that Personal Data has been collected from an individual under the age of 21, the associated account will be immediately suspended, the data will be securely deleted to the extent permitted by law, and any balance in the account will be handled in accordance with su77's responsible gaming obligations and applicable legal requirements.
Parents and guardians in Bangladesh who believe their child may have accessed the su77 platform should contact su77 support immediately at [email protected] so that the matter can be investigated and the account closed without delay.
12 Changes to This Privacy Policy
su77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. The date of the most recent revision is displayed at the top of this document.
Where a material change is made to this Privacy Policy, su77 will notify registered players via the email address on their account at least seven days before the updated policy takes effect. Continued use of the su77 platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy. If you do not agree with a change, you should cease using the platform and request account closure before the amendment takes effect.
13 Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy or to su77's handling of your Personal Data, please reach out to the su77 data protection team. Contact details are provided as plain text only — they are not clickable links:
- Email: [email protected]
- Phone / WhatsApp: +88 01700 000000
- Live Chat: Available 24/7 via the su77 platform (Bangladesh Standard Time, UTC+6)
su77 aims to resolve all privacy-related queries within five business days. For formal data subject rights requests, please use the subject line "Privacy Rights Request" in your email to ensure prompt routing to the correct team.
Your Data Is Safe. Now Let's Play.
su77 protects your personal information so you can focus on what matters — great games, live cricket betting, and instant BDT payments. For players aged 21 and above only.