ace4 Privacy Policy

01 Who We Are

ace4 ("we", "us", "our") operates the online betting and gaming platform accessible at ace4.io (the "Platform"), which offers sports wagering, live casino games, slots, and related entertainment services to registered players. ace4 acts as the data controller in respect of all personal data collected through the Platform.

This Privacy Policy applies to all personal data processed in connection with your registration, use of the Platform, participation in promotions, and any communications you have with ace4's support team. It should be read alongside the ace4 Terms and Conditions, which govern your use of the Platform as a whole.

02 Data We Collect

ace4 collects personal data in two broad categories: data you provide directly, and data we collect automatically through your use of the Platform. The table below summarises the specific categories of personal data we process.

ace4 does not collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless this is specifically required for responsible gaming assessments and you have given your explicit consent.

03 How We Collect Your Data

3.1 Data You Provide Directly

The majority of the personal data ace4 holds about you is data you provide directly at the time of registration, during the KYC verification process, when you make a deposit or withdrawal, when you complete a responsible gaming self-assessment, or when you contact our support team. You are not required to provide any personal data to browse publicly accessible parts of the Platform, but registration is required to place bets or access games.

3.2 Data Collected Automatically

When you access the Platform, our servers automatically record certain technical data including your IP address, the type of browser and device you are using, the pages you visit within the Platform, and the duration of your session. This data is collected using server logs and first-party cookies. It is used to maintain Platform security, diagnose technical problems, and analyse aggregated usage patterns to improve the user experience.

3.3 Data from Third Parties

In limited circumstances, ace4 may receive personal data about you from third parties. This occurs primarily when we use identity verification service providers (for KYC checks) or payment processors (to confirm transaction details). Any third-party data is handled with the same level of care and security as data you provide directly to ace4.

04 How We Use Your Data

ace4 uses personal data only for specific, legitimate purposes. We do not process your data in ways that are incompatible with the purpose for which it was originally collected. The primary uses of your personal data are set out below:

• Account Management: To create and maintain your ace4 account, verify your identity, and enforce the one-account-per-person rule.
• Service Delivery: To enable you to place bets, access casino games, and use all features of the ace4 Platform.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain an auditable record of all financial transactions.
• Legal Compliance: To fulfil our obligations under applicable anti-money laundering (AML) regulations, including the verification and retention of identity and transaction records.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bot usage, and other prohibited conduct on the Platform.
• Responsible Gaming: To monitor player behaviour patterns that may indicate problem gambling, to enforce deposit limits and self-exclusion elections, and to comply with responsible gaming obligations.
• Customer Support: To respond to your enquiries, resolve disputes, and improve the quality of our support services.
• Platform Improvement: To analyse aggregated, anonymised usage data to identify technical issues and improve the design and performance of the Platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and tournament announcements — but only where you have given your explicit consent to receive such communications and have not subsequently withdrawn that consent.

05 Legal Basis for Processing

ace4 processes personal data only where we have a valid legal basis for doing so. Depending on the specific processing activity, the applicable legal basis will be one or more of the following:

• Contractual Necessity: Processing that is required to fulfil our contractual obligations to you under the ace4 Terms and Conditions — for example, account creation, payment processing, and game access.
• Legal Obligation: Processing that is required to comply with applicable law, including AML regulations, KYC obligations, and data retention mandates.
• Legitimate Interests: Processing that is necessary for ace4's legitimate business interests, including fraud prevention, Platform security, and aggregate analytics — where such interests are not overridden by your rights and interests as a data subject.
• Consent: Processing that is based on your freely given, specific, informed, and unambiguous consent — applicable primarily to marketing communications and optional responsible gaming assessments. You may withdraw this consent at any time.

06 Data Sharing with Third Parties

ace4 does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. We share personal data with third parties only in the following limited and controlled circumstances:

6.1 Service Providers

ace4 engages carefully vetted third-party service providers to perform specific functions on our behalf, including identity verification (KYC providers), payment processing, cloud infrastructure hosting, fraud detection analytics, and customer support software. These providers act as data processors under binding data processing agreements and may only process your data as instructed by ace4 for the specified purpose.

6.2 Game Providers

When you play games supplied by third-party game studios — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi — limited technical data (such as a pseudonymous player identifier and session token) is shared with the relevant provider to facilitate the game session. These providers do not receive your full identity data or financial information.

6.3 Legal and Regulatory Disclosure

ace4 may disclose personal data to law enforcement agencies, regulatory bodies, or other authorised parties where required to do so by applicable law, court order, or in response to a lawful request from a competent authority. In such cases, ace4 will disclose only the minimum data necessary to satisfy the legal obligation and will notify you of any such disclosure to the extent permitted by law.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of ace4's business assets, personal data held by ace4 may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect, and you will retain all applicable data rights.

07 International Data Transfers

ace4 is an internationally operated platform, and some of the third-party service providers we engage may process personal data in countries outside Bangladesh. Where personal data is transferred internationally, ace4 takes appropriate steps to ensure that the transfer is subject to adequate safeguards, including the use of contractual clauses that impose data protection obligations equivalent to those applied within ace4's own operations.

By registering on the ace4 Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh. ace4 will not transfer personal data to any country or recipient that does not provide an adequate level of protection for personal data without first implementing the appropriate contractual or technical safeguards described above.

08 Cookies & Tracking Technologies

8.1 What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit the ace4 Platform. They allow the Platform to recognise your device across sessions, maintain your login state, remember your preferences, and collect anonymised analytics data about how the Platform is used.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without impacting your ability to use the Platform.
• Preference Cookies: Remember your settings and preferences — such as language preference and display options — so you do not have to re-enter them on each visit.
• Analytics Cookies: Collect anonymised, aggregated data about how players use the Platform — for example, which pages are visited most frequently and where users encounter technical issues. This data is used solely to improve Platform performance.

8.3 What We Do Not Use

ace4 does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or any cookies that track your browsing activity on websites other than ace4.io. We do not share cookie data with advertising networks.

09 Data Retention

ace4 retains personal data only for as long as is necessary for the purposes for which it was collected, or for as long as required by applicable law. The general retention periods applied by ace4 are summarised below:

• Account and Identity Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, as required by applicable AML and financial record-keeping regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial compliance requirements.
• Communications Data: Support communications and live chat transcripts are retained for two (2) years from the date of the interaction and then securely deleted.
• Technical and Usage Data: Server logs and session data are retained for a maximum of twelve (12) months and then automatically purged from active systems.
• Marketing Consent Records: Records of your marketing consent (or withdrawal of consent) are retained for as long as is necessary to demonstrate compliance with applicable law, and for a minimum of three (3) years.

When the applicable retention period expires, ace4 will securely delete or anonymise personal data so that it can no longer be associated with any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

10 Your Data Rights

As a data subject, you hold a number of rights in respect of the personal data that ace4 processes about you. These rights are set out below. To exercise any of these rights, please contact ace4 at [email protected] with a clear description of your request. We will respond within thirty (30) days and will not charge a fee for standard requests.

Please note that some of these rights are subject to limitations. For example, ace4 cannot erase identity or transaction data that is required to be retained for AML compliance purposes, regardless of a deletion request. Where a right cannot be fulfilled in full, ace4 will explain the specific reason in writing.

11 Children & Minors

The ace4 Platform is strictly intended for adults aged 21 years and above. ace4 does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under this age threshold, we will immediately suspend the relevant account, delete all associated personal data, and — where funds were deposited — follow our underage account procedures as set out in the Terms and Conditions.

If you believe that ace4 may hold personal data relating to a minor, please contact us immediately at [email protected]. We will treat any such report as a matter of priority and will investigate and respond within 48 hours.

12 Security Measures

ace4 implements a layered technical and organisational security framework to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser and the ace4 Platform is encrypted using TLS 1.3 with 256-bit encryption. The padlock icon in your browser's address bar confirms this encryption is active.
• Encryption at Rest: Personal data stored in ace4's databases is encrypted using AES-256, ensuring that data remains protected even in the event of unauthorised physical access to storage media.
• Access Controls: Access to systems containing personal data is restricted on a strict need-to-know basis. All staff access is authenticated using multi-factor authentication (MFA) and is subject to comprehensive audit logging.
• Fraud Detection Systems: ace4 operates real-time automated systems that monitor account activity for indicators of fraudulent behaviour, unauthorised access, and suspicious transaction patterns.
• Penetration Testing: ace4's Platform and infrastructure are subject to regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ace4 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights, ace4 will notify affected players and relevant authorities within the timeframe required by applicable law.

While ace4 takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. You are encouraged to use a strong, unique password for your ace4 account and to enable any additional authentication features made available by the Platform.

13 Changes to This Privacy Policy

ace4 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. When we make material changes, we will notify registered players by email and/or by posting a prominent notice on the Platform not less than fourteen (14) days before the changes take effect.

The "Last updated" date at the top of this document will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how ace4 protects your data. Your continued use of the Platform following the effective date of any update constitutes your acknowledgement of the revised policy.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to ace4's handling of your personal data, please contact our privacy team in the first instance:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Platform's live chat feature
• Response Time: We aim to acknowledge all privacy-related enquiries within two (2) business days and to provide a substantive response within thirty (30) days.

If you are not satisfied with ace4's response to your privacy enquiry or believe that ace4 has processed your personal data in a manner inconsistent with this Privacy Policy, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. ace4 will cooperate fully with any such regulatory investigation.