12bag Privacy Policy — Clear, simple, in plain language

What Information Is Collected?

Certain information is collected when you register and use 12bag's services. This falls into two categories — what you provide directly, and what is collected automatically.

1.1 Information You Provide

Information collected during registration and the KYC process:

• Full name & date of birth
• Email address and mobile number
• National ID number (for KYC verification)
• Bank account or mobile banking number (for payments)
• Address (where required)
• Selfie or ID photo (for KYC verification)

1.2 Automatically Collected Information

When you use the 12bag website or app, certain technical information is collected automatically:

• IP address and device type
• Browser version and operating system
• Login time and session data
• Game history and transaction logs
• Cookies and local storage data

How is the information we collect used?

12bag uses your information solely for the purposes listed below — nothing more.

2.1 Marketing Communications

With your permission, 12bag may occasionally send you information about new promotions or bonuses. You can opt out at any time through your account settings.

Where is your information stored, and for how long?

3.1 Storage Location

All 12bag data is stored on ISO 27001-certified cloud servers, monitored 24/7, and backed up regularly.

3.2 Retention Period

Different types of information are retained for different periods:

• Active account data: retained for as long as the account remains active
• Transaction logs: minimum 5 years (as required by law)
• KYC documents: 3 years after account closure
• Login & session data: 90 days
• Cookies: until browser is closed or expiry, whichever comes first

Is your information shared with others?

12bag never sells your information. However, in limited circumstances, it may be necessary to share certain data with third parties.

4.1 Cases Where Data Is Shared

• Payment processor: Limited information is shared with payment gateways to process deposits and withdrawals.
• KYC provider: Identity documents are shared with a licensed KYC provider for verification purposes.
• Law enforcement agencies: We are legally required to share information with law enforcement agencies when presented with a valid court order.
• Fraud prevention: Information about suspicious activity may be shared with industry-wide fraud databases.

4.2 What Is Never Shared

• Your information is never shared with advertisers or marketing companies
• No data is shared with social media platforms
• Never sold to data brokers or information resellers
• No information is shared with any third party without your consent

Cookies and Tracking

5.1 What Are Cookies?

Cookies are small text files stored in your browser. They help 12bag's services run smoothly.

5.2 Which Cookies Does 12bag Use?

• Essential cookies: Used to maintain your login session and ensure security. These cannot be disabled.
• Functional cookies: To remember your preferences — such as language or theme settings.
• Analytics cookies: Analyzing user behavior to improve site services.

5.3 Cookie Controls

You can disable non-essential cookies through your browser settings, though some features may not function as expected.

How Do We Keep Your Data Secure?

12bag uses a multi-layered security approach. If one layer is compromised, the others continue to protect your data.

6.1 Technical Security

• TLS 1.3 / 256-bit SSL encryption — all communications are secured
• Passwords are bcrypt-hashed — no one can view your password
• Two-Factor Authentication (2FA) — an extra layer of security
• Automatic brute force protection — repeated failed login attempts will lock the account
• Encrypted database — stored data is also encrypted

6.2 Organizational Security

• Restricted staff access — only authorized teams can view your data
• Regular security audits and penetration testing
• Staff data protection training
• A data breach response plan is in place

Your Data Rights

12bag believes you should have full control over your own data. You have the following rights:

7.1 Right to Access Your Data

You can request to see what information 12bag holds about you. Contact support and you will receive the information within 30 business days.

7.2 Right to Correct Your Data

You can request corrections to inaccurate or outdated information. Your details will be updated once your identity has been verified.

7.3 Right to Delete Your Data

When closing your account, you may request deletion of your data. However, certain information must be retained for a set period due to legal obligations.

7.4 Right to Object to Data Processing

You can opt out of your information being used for marketing purposes. Marketing communications can be turned off from your account settings.

Minors' Data

12bag is strictly for users aged 18 and above. We do not knowingly collect any information from minors.

If we become aware that a minor's information has been collected inadvertently, that information will be deleted immediately and the account will be closed.

If you become aware of a minor holding an account, please notify 12bag support immediately.

Privacy Policy Updates

12bag may update this Privacy Policy from time to time. Members will be notified of any significant changes via email or in-app notification.

The "Last Updated" date at the top of the policy is always kept current. Continued use of 12bag after any changes takes effect constitutes your acceptance of the revised policy.

Data protection contact

For any questions or concerns about this Privacy Policy or your data, please contact the 12bag Data Protection Team:

• Live chat: Bengali-language support available 24/7
• Email: [email protected]
• Complaints are responded to within 3 business days

Requests to delete, correct, or access your information are processed within 30 business days after identity verification.