Privacy Policy — sana101

1. Introduction

sana101 is committed to protecting the privacy and personal data of every player who registers and uses our online betting and casino platform. This Privacy Policy sets out in clear and accessible language how sana101 collects, processes, stores, transfers, and protects personal information in connection with the services we provide to players in Bangladesh and other permitted jurisdictions.

This policy applies to all data processing activities carried out by sana101 in connection with the operation of the platform, including account registration, deposits and withdrawals in BDT, sports betting, casino gaming, customer support interactions, promotional activity, and any other service offered through sana101. It covers data collected directly from players, as well as data collected automatically through the use of the platform.

We recognise that privacy is a fundamental right and that players should be informed about how their data is handled. The sana101 Privacy Policy is reviewed and updated regularly to reflect changes in our operations, technology, and applicable standards. The effective date at the top of this page reflects the most recent revision. We will notify registered players of any material changes to this policy by displaying a prominent notice within the platform or via email to the address associated with your account.

2. Data We Collect

sana101 collects personal data from players through a number of channels, including the account registration process, payment transactions, gameplay activity, customer support interactions, and through automated technical means when you use the platform. The categories of personal data we collect are described below.

2.1 Data You Provide Directly

When you register an account, complete identity verification, make a deposit or withdrawal, or contact our support team, you provide us with personal information that may include:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identification document details (National ID card number, passport number, or driving licence number).
• Contact Data: Residential address (including city — for example, Dhaka, Chittagong, Sylhet, Khulna, or Rajshahi), email address, and mobile phone number.
• Financial Data: Bank account details, mobile banking account identifiers (bKash, Nagad, Rocket, or Upay account numbers), deposit and withdrawal transaction history denominated in BDT.
• Account Credentials: Username and encrypted password. We store passwords using industry-standard hashing and never retain them in plain text.
• Support Communications: The content of live chat conversations, emails, and any documents you submit to the support team in connection with a query or complaint.
• Responsible Gaming Data: Self-exclusion requests, deposit limit settings, time-out elections, and any communications relating to problem gambling support.

2.2 Data Collected Automatically

When you access and use the sana101 platform, certain technical data is collected automatically by our systems. This includes:

• Device and Technical Data: IP address, browser type and version, operating system, device type and identifiers, screen resolution, and language preferences.
• Usage Data: Pages visited, features used, games played, bets placed, session duration, click-stream data, and time-stamped activity logs.
• Transaction Logs: A complete record of all financial transactions associated with your account, including deposit amounts, withdrawal requests, bonus crediting, and wagering history.
• Cookie and Tracking Data: Information collected through cookies, pixel tags, and similar tracking technologies as described in Section 5 of this policy.
• Location Data: Approximate geographic location derived from your IP address, used for fraud prevention, geographic access controls, and legal compliance purposes.

2.3 Data from Third Parties

In certain circumstances, sana101 may receive personal data about you from third parties, including identity verification service providers engaged to assist with KYC compliance, payment processing partners such as bKash, Nagad, Rocket, and Upay, fraud detection and anti-money-laundering screening services, and publicly available sources where permitted by applicable law. Data received from third parties is handled in accordance with the same standards set out in this policy.

3. How We Use Your Data

sana101 processes personal data only for specific, defined purposes. We do not use personal data in ways that are incompatible with the purpose for which it was collected. The table below summarises the main purposes for which we process personal data and the lawful basis on which each processing activity rests.

Purpose	Data Used	Lawful Basis
Account registration and management	Identity, contact, and credentials data	Performance of a contract
Identity verification (KYC)	Identity documents, date of birth, address	Legal obligation
Processing deposits and withdrawals in BDT	Financial data, transaction logs	Performance of a contract
Fraud prevention and anti-money laundering	Identity, financial, device, and location data	Legal obligation / legitimate interest
Responsible gaming monitoring	Usage data, wagering history, self-exclusion records	Legal obligation / legitimate interest
Customer support	Contact data, support communications	Performance of a contract
Platform improvement and analytics	Usage data, device data, cookie data	Legitimate interest
Promotional communications (where opted in)	Contact data, wagering preferences	Consent

Where sana101 relies on your consent to send promotional communications, such as offers related to the BPL season, Eid bonuses, or Pohela Boishakh promotions, you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting the support team. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

4. Data Sharing & Third Parties

sana101 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes under any circumstances. We may, however, share your personal data with carefully selected third parties where such sharing is necessary to operate the platform, comply with legal obligations, or protect the interests of our players. All third-party recipients of personal data are required to handle that data in a manner consistent with this Privacy Policy and applicable data protection standards.

4.1 Service Providers

We engage third-party service providers to perform functions on our behalf, including payment processing (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), identity verification and KYC services, fraud detection and risk management, cloud hosting and data storage infrastructure, customer support tooling, and email and notification delivery systems. These service providers are granted access to personal data only to the extent necessary to perform the specific services contracted and are prohibited from using that data for any other purpose.

4.2 Game Software Providers

Where you play games on the sana101 platform that are powered by third-party software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, certain technical and gameplay data may be processed by those providers in connection with the delivery of the game experience. These providers operate under their own data processing agreements and are not permitted to use gameplay data for independent marketing purposes.

4.3 Legal and Regulatory Disclosure

sana101 may be required to disclose personal data to law enforcement authorities, regulatory bodies, courts, or other competent authorities where such disclosure is required by applicable law or by a valid legal process. In such cases, we will disclose only the minimum amount of data necessary to satisfy the legal requirement and, where permitted to do so, will inform the affected player of the disclosure.

4.4 Business Transfers

In the event that sana101 undergoes a merger, acquisition, restructuring, or sale of all or a substantial portion of its assets, personal data held by the Company may be transferred to the acquiring entity as part of that transaction. In such circumstances, we will notify affected players and ensure that the receiving entity is bound by privacy commitments no less protective than those set out in this policy.

5. Cookies & Tracking Technologies

sana101 uses cookies and related tracking technologies to operate the platform effectively, improve the user experience, and gather analytical insights that help us develop and enhance our services for players in Bangladesh. This section explains what cookies are, how we use them, and how you can manage your cookie preferences.

5.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits, remember your preferences, maintain your session while you are logged in, and gather information about how you use the site. In addition to cookies, sana101 may use pixel tags (also called web beacons), local storage, and session storage for similar purposes.

5.2 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the operation of the sana101 platform. They enable core functions such as account login sessions, security token management, and fraud prevention. These cookies cannot be disabled without significantly impairing platform functionality.
• Functional Cookies: These cookies remember your preferences and settings, such as your preferred language, currency display (BDT), and notification preferences, so that you do not need to re-enter them on each visit.
• Analytical Cookies: These cookies collect aggregated, anonymised information about how players use the platform — for example, which games are most popular, which pages generate the highest engagement, and where users encounter difficulties. This data helps us improve the platform.
• Marketing and Retargeting Cookies: Where you have given consent, these cookies allow us to deliver relevant promotional content based on your past activity on the platform. You may opt out of marketing cookies at any time via your account settings.

5.3 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies, accept only certain cookies, or notify you when a cookie is being set. Please note that disabling strictly necessary cookies will impair the functionality of the sana101 platform and may prevent you from accessing certain features. Instructions for managing cookies in the most widely used browsers are available through the browser's own help documentation.

6. Data Security

sana101 implements a comprehensive range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes, but is not limited to, the following measures:

• SSL/TLS Encryption: All data transmitted between your device and the sana101 platform is encrypted using 256-bit SSL/TLS technology, ensuring that your personal and financial information is protected in transit.
• Password Hashing: Account passwords are stored using industry-standard cryptographic hashing algorithms. We never store passwords in plain text, and our support team cannot retrieve your password — only a reset can be performed.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. When activated, a one-time verification code is required at login in addition to your password, providing a second layer of account protection.
• Access Controls: Access to personal data held by sana101 is strictly limited on a need-to-know basis. Only authorised personnel with a specific operational requirement are permitted to access identifiable player data, and all such access is logged and audited.
• Secure Data Storage: Personal data is stored on secure servers protected by firewalls, intrusion detection systems, and regular security patching. Physical access to server infrastructure is restricted to authorised personnel only.
• Fraud Monitoring: Our systems conduct continuous automated monitoring for suspicious activity, including unusual login patterns, atypical transaction behaviour, and indicators of account compromise or identity fraud.

7. Your Rights & Choices

sana101 respects your rights in relation to your personal data. As a player on our platform, you are entitled to exercise the following rights at any time by contacting our support team at support@sana101:

• Right of Access: You have the right to request a copy of the personal data that sana101 holds about you. We will provide this information in a structured, readable format within a reasonable timeframe following a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain account details directly within your account settings without needing to contact support.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. Please note that this right is subject to limitations — we are required by law to retain certain records (such as transaction history and KYC documentation) for a minimum retention period even after account closure.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in specific circumstances, for example where you contest the accuracy of data while we verify it.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you have the right to receive your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You have the right to object to processing based on our legitimate interests, including the use of your data for analytical or profiling purposes. Where you object, we will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where we rely on your consent as the legal basis for processing (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to support@sana101 from the email address associated with your sana101 account. We may need to verify your identity before processing the request. We aim to respond to all data rights requests within 30 days. If a request is complex or involves a large volume of data, we may extend this period by a further 30 days and will inform you of the extension.

8. Data Retention

sana101 retains personal data for as long as it is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The key retention periods that apply to the main categories of personal data we hold are outlined below.

• Account and Identity Data: Retained for the duration of your account's active status plus a minimum of five years following permanent account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and Financial Records: All deposit, withdrawal, and wagering records denominated in BDT are retained for a minimum of five years from the date of the transaction.
• KYC Documents: Identity verification documents (copies of National ID, passport, etc.) are retained for a minimum of five years following the completion of the verification process or account closure, whichever is later.
• Support and Communications Records: Customer support interactions are retained for three years from the date of the most recent communication in the relevant thread.
• Responsible Gaming Records: Self-exclusion requests, deposit limit changes, and related communications are retained for a minimum of five years to ensure compliance with responsible gaming obligations and to prevent re-registration during exclusion periods.
• Analytical and Cookie Data: Anonymised analytical data is retained for up to 24 months. Cookie data is retained in accordance with the applicable cookie lifetime set at the time the cookie is placed.

When personal data is no longer required and no legal obligation exists to retain it, sana101 will securely delete or anonymise that data in accordance with our internal data destruction procedures. Anonymised data from which no individual player can be identified may be retained indefinitely for statistical and analytical purposes.