Privacy Policy — How Daraz Pay Protects Your Data

01 Introduction

This Privacy Policy describes how Daraz Pay ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal data of players and visitors who use the Daraz Pay website and mobile application. Daraz Pay is an online gaming platform serving players across Bangladesh, and this policy applies to all services we provide.

When you register an account on Daraz Pay, make a deposit, play a game , or contact our support team, you are sharing personal data with us. We take that responsibility seriously. This policy is written in plain language so that every Daraz Pay player — whether you are in Dhaka, Chittagong, Sylhet, or anywhere else in Bangladesh — can understand exactly how your data is handled.

This Privacy Policy should be read alongside the Daraz Pay Terms and Conditions, available at /terms-conditions. Together, these documents form the complete agreement between you and Daraz Pay regarding your use of the platform and the handling of your personal data.

02 Data We Collect

Daraz Pay collects only the personal data that is necessary to provide a safe, fair, and functional gaming service. The table below summarises the categories of data we collect and examples of each.

Daraz Pay does not collect sensitive personal data such as biometric data, health information, or political opinions. We do not access your device contacts, camera, or microphone unless you explicitly grant permission for a specific feature.

03 How We Collect Your Data

Daraz Pay collects your personal data through the following channels:

• Direct registration: When you create a Daraz Pay account, you provide your name, mobile number, date of birth, and preferred payment method directly through the registration form.
• Deposits and withdrawals: When you make a financial transaction on Daraz Pay, your payment account details and transaction reference numbers are recorded automatically.
• Gameplay: Every game session on Daraz Pay generates a server-side log that records the game played, bets placed, outcomes, and session duration. This data is used for fairness verification and dispute resolution.
• KYC verification: If you are asked to complete identity verification, you may submit a copy of your national ID card or other documents. These are processed securely and stored only for as long as required.
• Cookies and analytics: When you visit the Daraz Pay website or use the app, certain technical data is collected automatically. See Section 6 for full details on cookies.
• Customer support: When you contact Daraz Pay via live chat or email, the content of that communication is recorded and linked to your account for quality and compliance purposes.

04 Why We Use Your Data

Daraz Pay uses your personal data for specific, legitimate purposes. We do not use your data for any purpose that is not listed here. The table below maps each purpose to the data categories involved and the legal basis for processing.

• Account management: To create and maintain your Daraz Pay account, verify your identity, and manage your wallet balance. This is necessary to perform the contract between you and Daraz Pay.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, or Rocket, and to maintain accurate financial records. This is a contractual and legal obligation.
• Fraud prevention and security: To detect and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct. This is a legitimate interest and a legal obligation under applicable financial regulations.
• Regulatory compliance: To comply with applicable laws, including anti-money laundering requirements and age verification obligations. Daraz Pay is legally required to retain certain data for a minimum of five years.
• Customer support: To respond to your queries, resolve disputes, and improve the quality of our support service. This is a legitimate interest.
• Platform improvement: To analyse aggregated, anonymised usage data to improve game performance, platform stability, and user experience. Individual players are not identifiable in this analysis.
• Responsible gaming: To monitor gaming patterns and identify players who may be at risk of gambling-related harm, so that appropriate support can be offered. This is a legitimate interest and a platform obligation.
• Marketing communications: To send you promotional offers and platform updates via SMS or email, but only if you have opted in to receive such communications. You can opt out at any time.

05 Data Sharing

Daraz Pay does not sell your personal data. We share your data only in the limited circumstances described below, and only with parties who are contractually required to handle it securely and in accordance with this policy.

• Payment processors: Your payment account details are shared with bKash, Nagad, or Rocket solely to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are regulated financial service providers in Bangladesh.
• Identity verification providers: If KYC verification is required, your identity documents may be processed by a third-party verification service. This provider is bound by a data processing agreement with Daraz Pay and may not use your data for any other purpose.
• Game software providers: Game outcome data is shared with the relevant game provider for the purpose of fairness auditing and dispute resolution. No personally identifiable information is shared beyond what is necessary for this purpose.
• Legal and regulatory authorities: Daraz Pay may be required to disclose your personal data to law enforcement agencies, regulatory bodies, or courts if required by applicable law. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of Daraz Pay's business, your personal data may be transferred to the acquiring entity. You will be notified before any such transfer takes place and given the option to close your account.

All third parties with whom Daraz Pay shares personal data are required to implement appropriate technical and organisational security measures. Daraz Pay does not transfer personal data outside Bangladesh except where necessary for the services described above, and only with appropriate safeguards in place.

06 Cookies and Tracking

Daraz Pay uses cookies and similar tracking technologies on its website and mobile application. Cookies are small text files stored on your device that help the platform function correctly and improve your experience.

• Essential cookies: These are required for the platform to function. They manage your login session, maintain your wallet state, and ensure secure communication between your device and Daraz Pay's servers. These cookies cannot be disabled without breaking core platform functionality.
• Analytics cookies: These collect anonymised data about how players use the platform — which pages are visited most, how long sessions last, and where players encounter errors. This data helps Daraz Pay improve the platform. Analytics cookies can be disabled in your browser settings.
• Preference cookies: These remember your platform settings, such as your preferred language and notification preferences, so you do not have to reconfigure them each time you log in.

Daraz Pay does not use third-party advertising cookies or tracking pixels that follow you across other websites. The cookies we use are limited to what is necessary to operate and improve the Daraz Pay platform.

07 Data Retention

Daraz Pay retains your personal data for as long as is necessary to fulfil the purposes described in this policy, or as required by applicable law. The following retention periods apply:

• Account data: Retained for the duration of your account and for five years after account closure, in accordance with financial record-keeping requirements.
• Transaction records: Retained for a minimum of five years from the date of the transaction, as required by applicable anti-money laundering regulations.
• KYC documents: Retained for five years from the date of verification or account closure, whichever is later.
• Game logs: Retained for two years from the date of the game session, for the purpose of dispute resolution and fairness auditing.
• Support communications: Retained for two years from the date of the last communication in a support thread.
• Marketing preferences: Retained until you withdraw consent or close your account, whichever comes first.

When the applicable retention period expires, Daraz Pay securely deletes or anonymises your personal data so that it can no longer be linked to you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

08 Data Security

Daraz Pay implements a layered approach to data security. The following technical and organisational measures are in place to protect your personal data from unauthorised access, loss, or disclosure:

• All data transmitted between your device and Daraz Pay's servers is encrypted using TLS 1.3 or higher.
• Personal data stored on Daraz Pay's servers is encrypted at rest using AES-256 encryption.
• Access to personal data within Daraz Pay is restricted to staff who need it to perform their job functions. Access is logged and reviewed regularly.
• Daraz Pay's infrastructure is hosted on servers with physical security controls, including restricted access and 24/7 monitoring.
• Independent security audits are conducted quarterly. Penetration testing is carried out at least twice per year.
• All Daraz Pay staff who handle personal data receive mandatory data protection training on joining the company and annually thereafter.

While Daraz Pay takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You also play a role in keeping your data safe — use a strong, unique password for your Daraz Pay account and never share your login credentials with anyone.

09 Your Rights

As a Daraz Pay player, you have the following rights over your personal data. To exercise any of these rights, contact our support team via live chat or email at [email protected]. All requests are handled within 30 days.

10 Children's Privacy

Daraz Pay is strictly an adult platform. We do not knowingly collect personal data from anyone under the age of 18. Our registration process includes an age declaration, and we carry out age verification checks as part of our KYC process.

If Daraz Pay becomes aware that personal data has been collected from a person under the age of 18, that account will be closed immediately, all funds will be handled in accordance with our Terms and Conditions, and the personal data will be deleted as soon as it is no longer required for legal or compliance purposes.

11 Changes to This Policy

Daraz Pay may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable law. When we make changes, the updated policy will be published on this page with a revised "Last updated" date at the top.

For significant changes — particularly those that affect how we use your personal data or your rights — Daraz Pay will notify registered players via SMS or email at least seven days before the changes take effect. You will have the opportunity to review the changes and, if you do not agree, to close your account and withdraw your remaining balance before the new policy applies.

Continued use of Daraz Pay after the effective date of any policy update constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically so you are always aware of how your data is being handled.

12 Contact Us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how Daraz Pay has handled your personal data, please get in touch with our support team. We are available 24 hours a day, seven days a week.

• Live chat: Available directly within the Daraz Pay platform and mobile app. Average response time is under five minutes.
• Email: [email protected] — data rights requests are acknowledged within 24 hours and resolved within 30 days.
• FAQ: Common privacy questions are answered at /faq.

When submitting a data rights request, please include your registered mobile number and a brief description of your request so we can locate your account and respond efficiently. You may be asked to verify your identity before we process the request.