Privacy Policy — How daraplay Handles Your Data

Section 1

Information We Collect

daraplay collects personal information in three principal ways: information you provide directly during registration and account use, information generated automatically when you use the platform, and information received from third parties such as payment providers and identity verification services.

1.1 Information You Provide Directly

When you register an account or interact with daraplay, you may provide the following categories of personal data:

• Identity information: Full legal name, date of birth, and national identification number (NID) or passport details collected during KYC verification;
• Contact information: Mobile phone number, email address, and residential address (including district, division, and postcode within Bangladesh);
• Payment information: bKash account number, Nagad account number, Rocket account number, Upay account number, or partial card details (card type and last four digits only — full card numbers are not stored on daraplay servers);
• Account preferences: Responsible gaming limits, notification preferences, and communication opt-in status;
• Support correspondence: Any messages, complaints, or feedback you send to our support team at support@daraplay.

1.2 Information Collected Automatically

When you access the daraplay platform, our systems automatically record the following technical data:

• IP address and approximate geographic location (country and city level);
• Device type, operating system, and browser version;
• Session duration, pages visited, and in-platform navigation behaviour;
• Betting and gaming activity logs, including stake amounts, game selections, and transaction timestamps;
• Login timestamps and security event logs (e.g., failed login attempts, password change events).

1.3 Information from Third Parties

daraplay may receive personal data from the following third-party sources:

• Payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard): transaction confirmation references and mobile number or account verification status;
• Identity verification services: Confirmation of identity document validity during the KYC process;
• Fraud prevention databases: Risk indicators associated with an account or payment method, where such checks are required for platform security.

Section 2

How We Use Your Data

daraplay processes your personal data only for specific, legitimate purposes. The table below summarises the primary uses and the legal basis for each.

2.1 Marketing Communications

daraplay will only send promotional emails or SMS notifications to players who have explicitly opted in to receive such communications. You may withdraw this consent at any time by updating your notification preferences in your account settings or by contacting support@daraplay. Withdrawing consent for marketing does not affect the lawfulness of processing carried out prior to withdrawal, and it does not affect your ability to continue using the platform.

2.2 Automated Decision-Making

daraplay uses automated processes for certain fraud-detection and responsible gaming checks. For example, automated systems may flag unusual betting patterns or multiple login attempts for manual review. Where an automated decision has a significant effect on your account (such as a temporary suspension), you have the right to request human review of that decision by contacting support@daraplay.

Section 3

Data Sharing & Third Parties

daraplay does not sell your personal data. We share data only in the specific circumstances described below, and only to the minimum extent necessary for the stated purpose.

3.1 Service Providers

We engage trusted third-party service providers to support platform operations. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing networks receive only the data required to complete a specific transaction;
• KYC and identity verification providers: Receive document images and personal details solely for the purpose of confirming your identity;
• Cloud hosting and infrastructure providers: Store platform data on secured servers under strict data processing agreements;
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studios receive only a session token and player ID (not your full personal details) to deliver game content;
• Customer support tooling: Support ticket platforms receive your contact details and the content of your support communications.

All service providers operating on daraplay's behalf are contractually required to process your data only for the specified purpose and to maintain confidentiality and appropriate security standards.

3.2 Legal and Regulatory Disclosures

daraplay may be required to disclose personal data to law enforcement authorities, regulatory bodies, or courts of competent jurisdiction where we are legally compelled to do so. We will notify you of such a disclosure where we are legally permitted to do so and where it is practicable.

3.3 Business Transfers

In the event that daraplay undergoes a merger, acquisition, or sale of all or a substantial part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you in advance of any such transfer and of any resulting changes to this Privacy Policy.

Section 4

Cookies & Tracking

daraplay uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your session while you are logged in, and to protect against fraud and unauthorised access. This section explains the types of cookies we use and how you can manage them.

4.1 Types of Cookies We Use

4.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please be aware that disabling functional or analytics cookies may affect your experience on the daraplay platform. Strictly necessary cookies cannot be disabled without preventing core platform functionality from operating. Most modern browsers allow you to view, delete, and block cookies via the browser's settings or privacy menu.

4.3 No Third-Party Advertising Cookies

daraplay does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. Your on-platform activity is not reported to external advertising networks. The only tracking technologies in use are those operated directly by daraplay or by our essential service providers under strict data processing agreements.

Section 5

Data Security Measures

daraplay takes the security of your personal data seriously. We implement a layered set of technical and organisational measures to protect data against unauthorised access, disclosure, alteration, or destruction.

5.1 Technical Safeguards

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• Encryption at rest for sensitive fields including identity documents and payment account references;
• Access controls: Personal data is accessible only to daraplay personnel whose role requires it, governed by role-based access policies;
• Firewall and intrusion detection systems monitoring network traffic in real time;
• Regular security audits and penetration testing conducted by qualified third-party security professionals.

5.2 Organisational Safeguards

• All daraplay staff with access to personal data are trained in data protection and confidentiality obligations;
• Data processing agreements are in place with all third-party service providers who handle personal data on our behalf;
• A documented data breach response procedure is maintained, including notification protocols in the event of a significant breach.

5.3 Your Role in Security

While daraplay takes all reasonable steps to protect your data, security is a shared responsibility. You should use a strong, unique password for your daraplay account and not share your login credentials with anyone. If you suspect your account has been accessed without your authorisation, contact support@daraplay immediately so we can take protective action.

Section 6

Data Retention Policy

daraplay retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

Following expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for platform analytics and improvement purposes.

6.1 Requests for Early Deletion

You may request deletion of your personal data before the applicable retention period expires (see Section 7 — Your Privacy Rights). Please be aware that we may be legally unable to delete certain categories of data, such as transaction records, before the mandatory retention period elapses. In such cases, we will inform you of the specific data categories that cannot be deleted early and the reason why.

Section 7

Your Privacy Rights

As a daraplay player, you hold a number of rights in relation to the personal data we hold about you. We are committed to facilitating the exercise of these rights promptly and without unnecessary barriers.

7.1 Right of Access

You have the right to request a copy of the personal data that daraplay holds about you. This is sometimes called a Subject Access Request (SAR). We will provide the requested data in a readable electronic format within 30 days of receiving a valid request.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For straightforward updates such as a change of email address or mobile number, you may make the correction directly through your account settings. For identity-related corrections, please contact support@daraplay.

7.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent and there is no other lawful basis for processing, or where the data has been processed unlawfully. As noted in Section 6, certain data categories are subject to mandatory legal retention periods and cannot be erased on request before those periods expire.

7.4 Right to Restrict Processing

You may request that daraplay restricts the processing of your personal data in specific circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is under consideration. During a restriction period, we will store your data but not actively process it for the disputed purpose.

7.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit it to another service provider where technically feasible.

7.6 Right to Object

You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes, which will be honoured immediately upon receipt of your objection.

7.7 How to Exercise Your Rights

To exercise any of the rights listed above, contact our support team at support@daraplay with the subject line "Privacy Rights Request". Please include your registered name and the mobile number or email address associated with your account so we can verify your identity before processing the request. We aim to respond to all valid requests within 30 days. In complex cases we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.

Section 8

Changes to This Policy

daraplay reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. We are committed to keeping this document accurate and current.

8.1 Notification of Material Changes

Where we make a material change to this Privacy Policy — meaning a change that significantly affects how we collect, use, or share your personal data — we will notify registered players in advance via:

• A prominent notice on the daraplay platform visible upon login; and/or
• A notification to your registered email address or mobile number (for players who have opted in to communications).

We will give you a reasonable period (no less than 14 days) to review material changes before they take effect, unless we are legally required to implement a change with shorter notice. Continued use of the daraplay platform after the effective date of a revised Policy constitutes your acceptance of the revised terms.

8.2 Version History

The effective date shown at the top of this document reflects the date on which the current version came into force. Prior versions of this Privacy Policy are available on request by contacting support@daraplay. If you have questions about any change made in a particular version, our support team is happy to explain the nature of those changes in plain English.

8.3 Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how daraplay has handled your personal data, please contact us at support@daraplay. Our support team is available from 8 AM to Midnight Bangladesh Standard Time (BST, UTC+6), seven days a week. We will acknowledge your query promptly and work to resolve any concern as quickly as possible.

daraplay takes all privacy complaints seriously. If you are not satisfied with our response to a complaint, you may have the right to escalate the matter to a relevant data protection authority or seek independent legal advice.