Privacy Policy — How vipta Collects, Uses, and Protects Your Data

Introduction

vipta ("the Platform", "we", "us", "our") operates the online betting and entertainment website located at vipta.io, serving players in Bangladesh. This Privacy Policy ("Policy") explains how vipta collects, uses, stores, and protects the personal data of its registered users ("you", "the User", "the Player") and of visitors who browse vipta.io without registering an account.

vipta is committed to handling all personal data with care, transparency, and in strict accordance with applicable data protection principles. This Policy is intended to meet the standards of informed, meaningful consent and to give you a clear picture of your rights with respect to your personal information.

This Policy applies to all personal data collected through vipta.io, including data collected via the website registration flow, the account dashboard, customer support interactions, payment processing, and any other method by which you provide information to vipta. It does not apply to third-party websites or services to which vipta.io may link, even where those links appear within our platform.

Data We Collect

vipta collects personal data in the following categories. The specific data points collected depend on the nature of your interaction with the platform.

2.1 Registration and Identity Data

When you create a vipta account, we collect the following information:

• Full legal name (as it appears on your government-issued identification document);
• Date of birth (to verify that you meet the 21+ age requirement);
• Bangladesh mobile phone number (used as a primary account identifier and for two-factor authentication);
• Email address (used for account notifications and support communications);
• Residential address in Bangladesh;
• Username and hashed password.

2.2 Verification and KYC Data

As part of vipta's Know Your Customer (KYC) obligations under responsible gaming and anti-money laundering standards, we may collect:

• Copy of national identification card (NID), passport, or other government-issued photo ID;
• Proof of address documentation (e.g., utility bill or bank statement dated within 90 days);
• Proof of payment method ownership (e.g., screenshot of mobile money account in your name);
• Facial or biometric data only where required by a third-party KYC verification provider and only to the extent necessary to confirm document authenticity — vipta does not retain raw biometric data on its own servers.

2.3 Financial Transaction Data

To process deposits and withdrawals, we collect:

• Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard);
• Mobile wallet number or masked card number associated with the transaction;
• Transaction amounts, dates, and reference identifiers;
• Account balance history and betting/gaming activity records necessary for financial audit trails.

2.4 Technical and Device Data

When you access vipta.io, our servers and analytics tools automatically record:

• IP address and approximate geographic location derived from IP;
• Browser type, version, and operating system;
• Device type (desktop, mobile, tablet) and screen resolution;
• Pages visited, session duration, and navigation path within vipta.io;
• Referral source (the URL from which you arrived at vipta.io, if applicable).

2.5 Communications Data

When you contact vipta's support team or respond to communications from us, we retain:

• The content and timestamp of all support emails sent to or received from [email protected];
• Records of any responsible gaming requests, self-exclusion applications, or complaint submissions;
• Records of any promotional or marketing communications you have opted into or opted out of.

How We Collect Your Data

3.1 Directly from You

The majority of personal data vipta holds about you is provided directly by you — when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact support, or participate in a promotional campaign.

3.2 Automatically Through Technology

Technical and usage data is collected automatically by vipta's web servers and analytics infrastructure each time you visit vipta.io. This includes server logs, session tracking, and cookie-based data collection. See Section 7 (Cookies and Tracking) for full details on how vipta uses cookies and how you can manage your cookie preferences.

3.3 From Third-Party Service Providers

vipta may receive additional data about you from the following third-party sources in the course of delivering the platform's services:

• Payment processors — bKash, Nagad, Rocket, Upay, Visa, and Mastercard may provide transaction confirmation data, fraud signals, and identity verification outputs;
• KYC verification providers — third-party identity verification services engaged by vipta may return a verification outcome (pass, fail, or pending) along with data extracted from the document submitted;
• Game content providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other providers may transmit game session data (round IDs, bet amounts, outcomes) to vipta's systems for account-ledger reconciliation.

How We Use Your Data

vipta uses the personal data it collects for the following purposes:

4.1 Account Management

To create and maintain your vipta account, to verify your identity and age, to process login authentication, and to communicate account-related notifications (e.g., deposit confirmations, withdrawal approvals, password reset emails).

4.2 Service Delivery

To process deposits and withdrawals through your chosen payment method, to credit betting winnings to your account balance, to settle sports betting and casino game outcomes, and to provide access to all games and features available on vipta.io.

4.3 Regulatory Compliance and Legal Obligations

To conduct KYC verification and age checks in compliance with responsible gaming standards, to maintain financial transaction records for anti-money laundering (AML) audit purposes, to respond to lawful requests from competent authorities, and to investigate and prevent fraudulent activity on the platform.

4.4 Responsible Gaming

To monitor betting patterns for indicators of problem gambling behaviour, to facilitate the application of deposit limits, cooling-off periods, and self-exclusion requests, and to communicate responsibly with users who have activated responsible gaming tools on their accounts.

4.5 Customer Support

To receive, process, and respond to your support enquiries, complaints, and feedback submitted to [email protected]. Support records are retained to maintain continuity of service and for quality assurance purposes.

4.6 Platform Improvement and Analytics

To analyse aggregate, anonymised usage data with the aim of improving vipta.io's design, performance, content relevance, and user experience. vipta does not use individual-level behavioural profiling for purposes unrelated to service delivery or safety.

4.7 Marketing Communications

To send you promotional offers, bonus announcements, and relevant content where you have given explicit consent to receive such communications. You may withdraw your marketing consent at any time by contacting [email protected] with the subject line "Unsubscribe". Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

Legal Basis for Processing

vipta processes personal data on one or more of the following legal bases, depending on the purpose and nature of the processing activity:

• Contractual necessity — Processing that is required to fulfil our contractual obligations to you under the Terms & Conditions, including account management, payment processing, and game service delivery;
• Legitimate interests — Processing carried out to protect the platform from fraud, to improve service quality, and to maintain the security and integrity of vipta.io, where those interests are not overridden by your rights and interests;
• Legal obligation — Processing required to comply with applicable laws and regulatory standards, including KYC, AML, and responsible gaming obligations;
• Consent — Processing of your personal data for marketing communications and for optional cookies, where you have given clear, specific, and freely given consent. You may withdraw this consent at any time without detriment to your account.

Data Sharing and Disclosure

6.1 Service Providers

vipta shares personal data with a limited set of trusted third-party service providers who process data on vipta's behalf and under vipta's instructions. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard), KYC verification providers, game content providers, cloud hosting infrastructure providers, and email delivery services. All such providers are contractually bound to handle your data securely and to use it only for the specific purpose for which it was shared.

6.2 Legal and Regulatory Authorities

vipta may disclose your personal data to competent government authorities, law enforcement agencies, or regulatory bodies where required to do so by law, by a valid court order, or in connection with an investigation into suspected fraud, money laundering, underage gambling, or other criminal activity. vipta will only disclose the minimum amount of data necessary to comply with such requests.

6.3 Business Transfers

In the event that vipta undergoes a merger, acquisition, restructuring, or sale of assets, personal data held by vipta may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity assuming the privacy obligations described in this Policy. Users will be notified of any such transfer in advance where reasonably practicable.

6.4 What We Do Not Do

vipta strictly does not:

• Sell, rent, or lease your personal data to third-party advertisers or data brokers;
• Share your data with organisations for their independent marketing purposes;
• Transfer your data to any party in a manner inconsistent with this Privacy Policy without first providing you with notice and, where required, obtaining your consent.

Cookies and Tracking

7.1 What Are Cookies

Cookies are small text files placed on your device by vipta.io when you visit the site. They serve a range of functions, from keeping your session active while you navigate between pages to helping vipta understand how users engage with the platform so that we can improve it.

7.2 Types of Cookies vipta Uses

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to view, block, and delete cookies stored on your device. Please be aware that disabling strictly necessary cookies will impair your ability to log in and use vipta.io. Disabling functional cookies may affect your user experience. Disabling analytics and marketing cookies will not prevent you from using the platform but will limit vipta's ability to personalise your experience or measure campaign performance.

Data Retention

vipta retains personal data for the period necessary to fulfil the purpose for which it was collected and to meet applicable legal retention requirements. The following retention standards apply:

• Active accounts — Personal data is retained for the full duration of the account relationship;
• Closed accounts — Identity, KYC, and financial transaction data is retained for a minimum of five (5) years after account closure to satisfy anti-money laundering record-keeping obligations;
• Self-excluded accounts — A record of the self-exclusion is retained indefinitely to prevent re-registration in violation of the exclusion;
• Support communications — Support correspondence is retained for three (3) years following resolution of the interaction;
• Technical and usage data — Anonymised aggregate data may be retained indefinitely for analytical purposes; individual-level technical data is deleted or anonymised within twelve (12) months of collection.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. vipta does not retain data beyond what is legally or operationally necessary.

Data Security

vipta applies industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. The key measures in place include:

• TLS/SSL encryption — All data transmitted between your device and vipta.io is encrypted in transit using TLS 1.2 or higher;
• Password hashing — User passwords are stored as salted one-way cryptographic hashes. vipta staff cannot access or retrieve your plaintext password;
• Role-based access controls — Access to personal data within vipta's internal systems is restricted to staff members who require it to perform their specific job functions, on a need-to-know basis;
• Regular security reviews — vipta conducts periodic security assessments of its infrastructure, including vulnerability scans and review of access logs;
• Incident response — vipta maintains a documented data breach response procedure. In the event of a breach that poses a material risk to users, affected users will be notified without undue delay.

Your Rights

As a vipta user, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact vipta at [email protected] with the subject line "Data Rights Request". vipta will acknowledge your request within two business days and aim to fulfil it within five business days, subject to identity verification and any applicable legal constraints.

• Right of Access — You may request a copy of the personal data vipta holds about you, along with information on how it is used and with whom it has been shared;
• Right to Rectification — You may request correction of any inaccurate or incomplete personal data held by vipta;
• Right to Erasure — You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to vipta's legal retention obligations;
• Right to Restriction — You may request that vipta restrict the processing of your data while a rectification request is being resolved or while the lawfulness of processing is under dispute;
• Right to Data Portability — You may request that vipta provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider where technically feasible;
• Right to Object — You may object to processing based on legitimate interests, including direct marketing communications. vipta will honour objections to marketing immediately upon receipt;
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Children and Minors

vipta's platform is strictly intended for adults aged 21 and above. vipta does not knowingly collect personal data from any individual under the age of 21. If vipta becomes aware that personal data has been collected from a minor, that data will be deleted promptly and the associated account will be permanently closed.

If you are a parent or guardian and believe that a person under the age of 21 has registered an account with vipta using false information, please contact us immediately at [email protected] with the subject line "Underage Account Report". vipta takes all such reports seriously and will investigate and act without delay. All personal data collected in connection with an underage account will be securely deleted following account closure.

Third-Party Services

vipta.io may contain links to third-party websites or integrate third-party game content and payment interfaces that operate under their own privacy policies. vipta is not responsible for the data practices of any third party. We encourage you to review the privacy policy of any third-party service you access through or in connection with vipta.io.

Game content provided by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other providers is delivered through embedded interfaces that may transmit limited technical data (such as session tokens and game round results) to the provider's servers for game operation purposes. These providers operate under their own data agreements and are contractually bound to process such data only for service delivery.

Payment processing via bKash, Nagad, Rocket, Upay, Visa, and Mastercard is handled directly by those providers' secure infrastructure. vipta does not store full card numbers or mobile banking PINs. Each payment provider's privacy policy governs their handling of your financial credentials during a transaction.

Changes to This Policy

vipta reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, platform features, or data processing practices. When material changes are made, vipta will:

• Update the effective date displayed at the top of this document;
• Post a notice on vipta.io informing users of the change;
• Where practicable, notify registered users via their registered mobile number or email address.

Your continued use of vipta.io after the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree to the revised terms, you should discontinue use of the platform and request account closure by contacting [email protected].

Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or vipta's data processing practices, please contact our support team using the details below. vipta is committed to resolving all privacy-related enquiries promptly and transparently.

14.1 Contact Details

Email (plain text — not a link): [email protected]
Subject line for privacy enquiries: "Privacy Policy Enquiry"
Subject line for data rights requests: "Data Rights Request"
Subject line for underage account reports: "Underage Account Report"
Response time: Within two (2) business days of receipt, Bangladesh Standard Time (BST, UTC+6).

14.2 Complaints Process

If you are dissatisfied with vipta's response to a privacy-related complaint, you may escalate your complaint in writing to [email protected] with the subject line "Privacy Escalation". A senior member of vipta's compliance team will review escalated complaints and provide a final written response within ten (10) business days.

vipta takes all privacy complaints seriously. We encourage users to raise concerns directly with us in the first instance so that we have the opportunity to resolve matters before any external escalation is considered.