Privacy Policy

This Privacy Policy ("Policy") describes how vavada ("vavada", "the Platform", "we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("you", "Player", "User") who access or use the vavada website at vavada.bio and all associated services (collectively, the "Services").

vavada is committed to handling your personal data with transparency, integrity, and care. We apply industry-standard security practices to protect the data entrusted to us and we will never sell your personal information to third parties for marketing purposes.

This Policy applies to all personal data collected in connection with your use of the Platform, including data gathered during account registration, identity verification, deposits, withdrawals, gameplay, customer support interactions, and marketing communications. By registering an account on vavada or by continuing to use the Services, you acknowledge that you have read and understood this Policy.

The categories of personal data that vavada collects and processes include, but are not limited to, the following:

We collect only the data that is necessary and proportionate to the purposes described in this Policy. We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or health information, except where you voluntarily provide such information in the context of a responsible gaming self-exclusion request (e.g., disclosing a gambling disorder).

vavada collects personal data through the following channels:

• Direct Interactions: You provide Identity Data, Contact Data, and Financial Data when you register an account, complete KYC verification, make deposits or withdrawal requests, or contact our support team.
• Automated Technologies: As you navigate the Platform, we automatically collect Technical Data and Usage Data using cookies, server logs, and similar tracking technologies. See Section 7 for details on our use of cookies.
• Third-Party Verification Providers: Our KYC and identity verification partners may return verified identity information to us as part of the onboarding and ongoing compliance process.
• Payment Processors: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment processor shares transaction confirmation data with us.
• Analytics Providers: Aggregated and anonymised usage statistics may be received from analytics tools deployed on the Platform to help us understand how players interact with our services.

vavada processes your personal data for the following clearly defined purposes:

• Account Registration and Management: To create and maintain your vavada account, verify your identity, process your login credentials, and manage your account preferences and responsible gaming settings.
• Payment Processing: To process deposits and withdrawal requests in Bangladeshi Taka via bKash, Nagad, Rocket, Upay, bank transfer, and card payment methods, and to maintain accurate transaction records.
• Identity Verification (KYC): To verify that you are who you claim to be, that you meet the minimum age requirement of 18 years, and that your payment accounts are registered in your own name, in accordance with our anti-money laundering obligations.
• Service Delivery: To provide you with access to sports betting markets, live casino games, slots, crash games, and all other features available on the Platform.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, bonus abuse, and other unlawful conduct on the Platform.
• Customer Support: To respond to your queries, complaints, and requests submitted via email at [email protected] or through any other support channel we make available.
• Responsible Gaming: To action self-exclusion requests, deposit limit adjustments, session time reminders, and other responsible gaming tools requested by you or applied by vavada in accordance with our duty of care obligations.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including anti-money laundering requirements, record-keeping mandates, and responses to lawful requests from regulatory or law enforcement bodies.
• Marketing Communications: Where you have provided consent or where we have a legitimate interest, to send you promotional offers, bonus notifications, and news about vavada. You may opt out of marketing communications at any time by contacting [email protected].
• Platform Improvement: To analyse aggregated usage data in order to improve the functionality, performance, and user experience of the Platform.

We do not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

vavada processes personal data on the following legal bases:

• Contractual Necessity: Processing that is necessary to perform the contract between you and vavada — specifically, the Terms and Conditions you accept upon registration. This covers account management, payment processing, KYC verification, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering obligations, age verification mandates, and responses to lawful orders from competent authorities.
• Legitimate Interests: Processing for purposes that serve vavada's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud prevention, platform security monitoring, responsible gaming oversight, and analytics for service improvement.
• Consent: Where no other legal basis applies, we will seek your explicit consent before processing your data. This applies primarily to optional marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

vavada does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data in the following limited and controlled circumstances:

• KYC and Identity Verification Providers: We engage trusted third-party identity verification services to assist with document checking and age verification. These providers process your KYC documents solely on our behalf and under strict data processing agreements.
• Payment Processors: Transaction data is shared with payment providers including the operators of bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and card processing networks (Visa, Mastercard) as necessary to execute your deposit and withdrawal instructions.
• Game Content Providers: Certain gameplay data (e.g., bet history, game session identifiers) may be shared with our licensed game studio partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — solely for the purpose of game operation, fairness auditing, and technical support.
• IT and Cloud Service Providers: We use third-party hosting, cloud storage, and cybersecurity providers to operate and secure the Platform. These providers act as data processors and are contractually bound to process your data only as instructed by vavada.
• Analytics Providers: Aggregated and pseudonymised usage statistics may be shared with analytics tools. We configure these tools to minimise the collection of identifiable data and to prevent the analytics provider from using your data for their own purposes.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where required to do so by applicable law, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of vavada, our players, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of vavada's assets, your personal data may be transferred to the acquiring entity. We will notify registered players by email prior to any such transfer and the acquiring entity will be bound by this Privacy Policy.

vavada uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and gather analytical insights. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Disabling analytical or marketing cookies will not affect your ability to use the core services.

vavada retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account Data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, to meet anti-money laundering record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, in accordance with applicable financial crime prevention requirements.
• Transaction Records: All deposit and withdrawal transaction records are retained for a minimum of five (5) years for regulatory compliance and dispute resolution purposes.
• Customer Support Communications: Support tickets, email correspondence, and complaint records are retained for three (3) years following resolution of the relevant matter.
• Technical and Usage Data: Server logs and technical data are retained for up to twelve (12) months. Aggregated, anonymised analytics data may be retained indefinitely as it no longer constitutes personal data.
• Marketing Consent Records: Records of your consent to or opt-out from marketing communications are retained for the duration of your account, plus three (3) years.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures. You may request early deletion of your data subject to the conditions described in Section 10.

vavada implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• SSL / TLS Encryption: All data transmitted between your device and the vavada Platform is protected using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption. You will see a padlock icon in your browser address bar confirming an encrypted connection.
• Password Hashing: Account passwords are never stored in plain text. They are processed using industry-standard one-way cryptographic hashing algorithms before storage.
• Access Controls: Access to personal data within vavada's internal systems is restricted to authorised personnel who have a legitimate operational need. Role-based access controls and audit logging are in place.
• Two-Factor Authentication: OTP-based verification via your registered mobile number is used as an additional authentication layer for sensitive account actions, including withdrawals and password changes.
• Vulnerability Management: The Platform undergoes regular security assessments to identify and remediate potential vulnerabilities in our infrastructure and application code.
• Incident Response: vavada maintains documented procedures for detecting, containing, and responding to data security incidents. Where a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected players without undue delay.

While we apply rigorous security standards, no system connected to the internet can be guaranteed to be completely impenetrable. You also bear responsibility for the security of your own device and login credentials. See Section 4 of our Terms and Conditions for account security obligations.

As a vavada player, you have the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] from your registered email address:

• Right of Access: You have the right to request a copy of the personal data that vavada holds about you, together with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update basic account details directly within your account dashboard; for KYC document corrections, please contact support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to overriding retention obligations under applicable law (e.g., the five-year AML record-keeping requirement described in Section 8).
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or object to our processing on grounds of legitimate interest.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for marketing purposes. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We will respond to all valid data rights requests within thirty (30) calendar days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reasons for it.

vavada is strictly an adults-only platform. We do not knowingly collect, process, or store personal data relating to individuals under the age of eighteen (18). Account registration requires an affirmative declaration that the applicant is 18 years of age or older, and this declaration is supported by mandatory KYC age verification before withdrawal rights are activated.

If vavada discovers that personal data has been collected from an individual who is under 18 years of age, the account will be immediately suspended and permanently closed, all associated data will be deleted as promptly as our legal retention obligations allow, and any funds held in the account will be returned to the depositing payment method following an investigation.

If you are a parent or guardian and you believe that a minor has registered an account on vavada without your knowledge, please contact us immediately at [email protected] so that we can take appropriate action without delay.

The vavada Platform integrates third-party services — including payment processors, game content providers, and analytics tools — that are necessary for the operation of our Services. When you interact with these integrated services, the third party's own privacy policy governs their collection and use of your data to the extent that data passes beyond vavada's direct control.

vavada selects third-party service providers carefully and requires all providers who process personal data on our behalf to enter into data processing agreements that bind them to confidentiality obligations and restrict their use of your data to the specific purpose for which it was shared. We do not permit any third-party processor to use your data for their own commercial purposes.

Game content studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi operate under their own licensing and compliance frameworks. Gameplay data shared with these providers is used solely for game operation and technical audit purposes and is governed by the contractual terms between vavada and each respective provider.

Payment method providers including bKash, Nagad, Rocket, Upay, and affiliated banks operate under their own regulatory obligations and privacy practices. vavada is not responsible for the data practices of these payment providers once a transaction has been initiated on their respective platforms.

vavada reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, the services we offer, applicable legal requirements, or feedback from our players and regulators. We will indicate the effective date of the most recent revision at the top of this page.

Where we make material changes to this Policy — particularly changes that affect how we use your personal data or the rights available to you — we will notify registered players by email to their registered address at least seven (7) calendar days before the changes take effect. We may also display a prominent notice on the Platform during this period.

Your continued use of the vavada Platform after the effective date of any update constitutes your acknowledgement of the revised Policy. If you do not agree with the updated Privacy Policy, you should cease using the Platform and request account closure by contacting [email protected] before the revised Policy takes effect.

If you have any questions, concerns, or complaints relating to this Privacy Policy or the way vavada handles your personal data, please contact our support team. We take all privacy enquiries seriously and will respond as promptly as possible during Bangladesh Standard Time (BST, UTC+6) business hours.

For responsible gaming concerns including self-exclusion requests, deposit limit changes, and account cool-off requests, these are treated as the highest priority and will be actioned within twenty-four (24) hours of receipt. For more information visit our Responsible Gaming page.