Privacy Policy — How m89 Protects Your Data

01 Information We Collect

m89 collects personal information from players in Bangladesh through several channels: directly from you during registration and account management, automatically through your use of the platform, and from trusted third-party sources where permitted. The categories of personal data we collect are described in detail below.

1.1 Registration and Account Data

When you create an m89 player account, we collect the following information: your full legal name, date of birth, residential address (including district, division, and postcode within Bangladesh), email address, and mobile phone number. This information is required to establish your account identity, verify your age (players must be 18 years or older), and communicate with you about your account.

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) obligations and to process withdrawal requests, m89 collects copies of government-issued identity documents. Acceptable documents include the Bangladesh National Identity Card (NID), passport, or driver's licence. These documents are used solely for identity and age verification purposes and are stored securely with restricted internal access.

1.3 Financial and Payment Data

When you make a deposit or request a withdrawal, m89 collects transaction-related data including your payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank), transaction reference numbers, and the amounts transacted in Bangladeshi Taka (৳). We do not store full card numbers or mobile banking PINs on our servers — these are handled exclusively by our certified payment processing partners.

1.4 Usage and Behavioural Data

As you interact with the m89 platform, we automatically collect data about your activity, including: the games you play, bet amounts and outcomes, session duration, pages and features accessed, bonus claims and wagering activity, and any customer support interactions. This data helps us personalise your experience, detect problematic gambling patterns, and improve our platform.

1.5 Technical and Device Data

We collect technical information about the device and network you use to access m89, including: IP address, device type and model, operating system, browser type and version, screen resolution, and connection type. This information is used for security monitoring, fraud prevention, and to ensure the platform functions correctly across the wide range of devices used by players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and other parts of Bangladesh.

1.6 Communications Data

If you contact our support team at [email protected], we retain records of those communications including the content of your messages, timestamps, and any attachments. This enables us to manage your query, maintain a history of account-related issues, and train our support staff.

02 How We Use Your Data

m89 uses the personal data collected from players for a range of clearly defined purposes. We will never use your data for a purpose that is incompatible with the reason it was originally collected without first seeking your consent.

2.1 Account Management and Service Delivery

Your registration data and account information is used to create and maintain your m89 player account, authenticate your identity on login, process deposits and withdrawals in BDT (৳), deliver your chosen games and betting markets, and administer the promotions and bonuses you claim. Without this data, we cannot provide the core m89 service.

2.2 Identity Verification and Fraud Prevention

m89 uses your KYC documents and account data to verify that you meet our eligibility requirements — specifically that you are aged 18 or above and are entitled to use the platform. We also use device and IP data to detect and prevent fraud, bonus abuse, duplicate account creation, and money laundering. Automated systems and manual review processes are both employed for this purpose.

2.3 Personalisation and Recommendations

With your consent (expressed through your continued use of the platform), m89 uses your gameplay history and preferences to personalise the content displayed to you — including game recommendations, promotional offers relevant to your activity, and news about sporting events such as BPL, IPL, and T20 tournaments that match your betting interests.

2.4 Responsible Gaming Monitoring

m89 analyses your session data, wagering frequency, deposit patterns, and self-assessment responses to monitor for signs of harmful gambling behaviour. This analysis may trigger automated alerts or proactive contact from our responsible gaming team. Using your data in this way is a core part of our duty of care to players across Bangladesh.

2.5 Legal and Regulatory Compliance

m89 is required to retain certain categories of player data to comply with applicable financial, anti-money-laundering (AML), and record-keeping obligations. We may use your data to respond to requests from law enforcement or regulatory authorities where we are legally obligated to do so.

2.6 Platform Improvement and Analytics

Aggregated and anonymised usage data helps m89 understand how players interact with the platform — which features are most popular, where technical issues occur, and how the user experience can be improved. This analysis does not identify individual players and is used only at an aggregate level.

2.7 Marketing Communications

If you have opted in to receive marketing communications from m89, we may send you promotional emails or SMS messages about new games, seasonal offers (such as Eid or Pohela Boishakh promotions), and enhanced odds on upcoming cricket fixtures. You may withdraw your consent to marketing communications at any time by contacting [email protected] or adjusting your account notification settings.

03 Data Sharing and Disclosure

m89 does not sell or rent your personal data to any third party. We may, however, share specific categories of your data with trusted partners and authorities where strictly necessary for the following purposes.

3.1 Payment Processing Partners

To process your deposits and withdrawals in BDT (৳), m89 shares the minimum necessary transaction data with our certified payment partners — including bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank. These partners are bound by their own data protection obligations and are contractually prohibited from using your data for any purpose other than processing the relevant transaction.

3.2 Game Content Providers

m89 hosts games supplied by third-party game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi. To load and operate these games, limited technical session data (such as a session token and account reference) is passed to the relevant game provider. No personal contact data or payment data is shared with game studios.

3.3 Identity Verification Services

For KYC and age verification, m89 may use authorised third-party identity verification providers. These providers receive the identity documents you submit and return a verification result to m89. Your identity documents are processed by these providers under strict data processing agreements and are not retained by them beyond the verification process.

3.4 Legal and Law Enforcement Disclosures

m89 may disclose player data to courts, law enforcement agencies, or regulatory bodies where we are required to do so by applicable law, a valid court order, or a legitimate regulatory request. In such cases, we will disclose only the minimum data required to satisfy the legal obligation.

3.5 Business Transfers

In the event that m89 undergoes a corporate restructuring, merger, or acquisition, player data held by m89 may be transferred to the acquiring entity as part of that transaction. Any such transfer would be subject to equivalent data protection obligations, and affected players would be notified via their registered email address prior to any transfer where reasonably practicable.

04 Cookies and Tracking Technologies

m89 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and understand how the site is used. This section explains the types of cookies we use and how you can manage them.

4.1 What Are Cookies?

Cookies are small text files placed on your device by the m89 website when you visit. They allow the site to recognise your device on return visits, maintain your logged-in session, remember your language and display preferences, and collect anonymous analytics data. Cookies do not contain your password, payment information, or identity documents.

4.2 Types of Cookies Used by m89

4.3 Managing Your Cookie Preferences

You can manage or disable non-essential cookies through your browser settings at any time. Most modern browsers allow you to block third-party cookies, clear existing cookies, or be notified when a cookie is set. Please be aware that disabling strictly necessary cookies will prevent the m89 platform from functioning correctly — specifically, you will not be able to maintain a logged-in session or use the cashier.

4.4 Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal that requests websites to disable cross-site tracking. m89 respects this signal where technically feasible and will not enable non-essential tracking technologies for browsers transmitting a DNT signal. Strictly necessary cookies required for platform operation are not affected by DNT settings.

05 Data Retention

m89 retains your personal data only for as long as is necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable legal and regulatory obligations. When data is no longer needed, it is securely deleted or anonymised.

5.1 Active Account Data

While your m89 account remains active, we retain all account registration data, KYC documents, transaction history, and usage data associated with your account. This data is required to operate your account and fulfil our legal obligations as a financial services operator handling transactions in BDT (৳).

5.2 Closed Account Data

Following the closure of your m89 account — whether voluntarily requested or imposed by m89 — your personal data and transaction records are retained for a minimum period of 5 years from the account closure date. This retention period reflects our obligations under applicable anti-money-laundering and financial record-keeping requirements. After the retention period expires, your data is securely and permanently deleted.

5.3 Marketing Data

If you withdraw your consent to marketing communications, your contact details will be removed from our marketing distribution lists within 14 days of your opt-out request. A suppression record (containing only your email address or mobile number and the opt-out date) may be retained indefinitely to ensure we do not inadvertently re-add you to our mailing list.

5.4 Support Communications

Records of your communications with the m89 support team are retained for 3 years from the date of the most recent interaction in a given ticket thread. After this period, support records are permanently deleted unless they form part of an ongoing dispute or legal matter.

06 Data Security Measures

m89 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. While no platform can guarantee absolute security, m89 applies industry-standard practices to minimise risk.

6.1 Encryption in Transit and at Rest

All data transmitted between your browser or mobile device and the m89 platform is encrypted using TLS 1.2 or higher. Sensitive data stored in our databases — including identity documents, payment references, and account credentials — is encrypted at rest using AES-256 encryption. Passwords are stored as salted cryptographic hashes and can never be retrieved in plain text — not even by m89 staff.

6.2 Access Controls

Access to player personal data within m89's internal systems is restricted on a strict need-to-know basis. Staff members are assigned the minimum level of data access required to perform their role. All internal access to sensitive player data is logged and subject to regular audit. Former staff members have their access credentials revoked immediately upon leaving the organisation.

6.3 Two-Factor Authentication

m89 strongly recommends that all players enable two-factor authentication (2FA) on their accounts. 2FA adds a second layer of security beyond your password, requiring a one-time code sent to your registered mobile number each time you log in from an unrecognised device. This significantly reduces the risk of unauthorised access even if your password is compromised.

6.4 Security Incident Response

In the event of a data security incident that poses a risk to your personal data, m89 has a documented incident response plan in place. Affected players will be notified at their registered email address within a reasonable timeframe following our discovery of the incident. The notification will describe the nature of the incident, the categories of data affected, and the steps we have taken or recommend you take to protect yourself.

6.5 Your Responsibility

Account security is a shared responsibility. You are responsible for keeping your m89 login credentials confidential, using a strong and unique password, logging out of your account on shared devices, and notifying us immediately at [email protected] if you suspect unauthorised access to your account. m89 cannot be held responsible for security breaches that result from a player sharing their own credentials or using a weak password.

07 Your Privacy Rights

As an m89 player, you hold a number of rights in relation to the personal data we hold about you. m89 is committed to honouring these rights and will respond to all valid requests in a timely manner. To exercise any of the rights described in this section, please contact [email protected] with a clear description of your request.

7.1 Right of Access

You have the right to request a copy of all personal data that m89 holds about you. Upon receipt of a valid access request, m89 will provide a summary of your data in a portable, readable format within 30 days. For complex or voluminous requests, this period may be extended by a further 30 days, and you will be notified of the extension.

7.2 Right to Rectification

If any personal data that m89 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For account information such as your email address, mobile number, or residential address, you may update these directly within your account profile. For corrections to identity documents or legal name records, please contact our support team.

7.3 Right to Erasure

You have the right to request that m89 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. Please note that this right is subject to our legal obligations — m89 may be required to retain certain categories of data for the periods described in Section 5 even following a deletion request.

7.4 Right to Restrict Processing

You may request that m89 restrict the processing of your personal data in specific circumstances — for example, while the accuracy of data is being verified following a rectification request, or while an objection to processing is being assessed. During a restriction period, m89 will continue to store your data but will not actively process it beyond what is strictly necessary.

7.5 Right to Object to Marketing

You have the right to object to your personal data being used for direct marketing purposes at any time. Upon receipt of a valid objection, m89 will remove you from all marketing distribution lists within 14 days. Transactional and account-management communications (such as deposit confirmations, withdrawal notifications, and security alerts) are not affected by a marketing objection.

7.6 Right to Data Portability

Where your data has been provided by you and is processed on the basis of your consent or a contract, you have the right to receive that data in a structured, commonly used, and machine-readable format (such as CSV or JSON). You may also request that m89 transmit this data directly to another service provider where technically feasible.

08 Updates to This Privacy Policy

m89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. The "Effective Date" shown at the top of this document will be updated each time a new version is published.

8.1 Notification of Material Changes

Where changes to this Privacy Policy are material — meaning they significantly affect how your personal data is collected, used, or shared — m89 will notify all registered players via the email address held on their account at least 14 days before the updated policy comes into effect. For minor clarifications or corrections that do not materially alter your rights or our obligations, the policy may be updated without advance notice.

8.2 Continued Use as Acceptance

Your continued use of the m89 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you should cease use of the platform and may request account closure by contacting [email protected].

8.3 Contact for Privacy Matters

If you have any questions, concerns, or complaints regarding this Privacy Policy or m89's data handling practices, please contact our dedicated privacy support address. All privacy-related queries are handled in English and are treated with strict confidentiality.

This Privacy Policy was last reviewed and updated on 1 January 2026. m89 is committed to fair, transparent, and responsible data handling for all players. 18+ only. Play responsibly.