iv18 Privacy Policy

This Privacy Policy is published by iv18 ("iv18", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://iv18.io (the "Platform"). iv18 is the data controller responsible for the personal data of all registered players and visitors to the Platform.

The iv18 Platform is designed and operated primarily to serve players located in Bangladesh. Our registered support contact for all privacy-related matters is [email protected]. If you have any questions about this Privacy Policy or about how iv18 handles your personal data, you may contact our support team at that address at any time. Support is available 24 hours a day, 7 days a week, with a response time of within 2 hours.

By accessing the Platform, creating an iv18 account, making a deposit, placing a bet, or otherwise using our services, you confirm that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not consent, you must cease using the Platform immediately.

iv18 collects personal data in several categories depending on your interaction with the Platform. The categories of personal data we may hold about you are described below.

iv18 does not intentionally collect special categories of sensitive personal data (such as health information, racial or ethnic origin, religious beliefs, or political opinions) except where explicitly required for regulatory compliance purposes and where you have provided explicit consent.

iv18 collects personal data through the following methods:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting a form on the Platform.
• Automated technical collection: Data collected automatically through cookies, server logs, and similar tracking technologies each time you access the Platform. This includes your IP address, browser fingerprint, device identifiers, and session behaviour.
• Payment processor data: When you initiate a financial transaction via bKash, Nagad, Rocket, Upay, or a Bangladeshi bank, the relevant payment processor may share confirmation and reference data with iv18 to reconcile the transaction against your account.
• Identity verification providers: Where iv18 uses a third-party KYC or identity verification service to confirm the authenticity of documents you submit, that provider may return verification results and data flags to iv18.
• Fraud prevention and risk services: iv18 may receive data signals from third-party fraud detection services to help identify suspicious account activity or protect the Platform from abuse.
• Game providers: Certified game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may transmit gameplay records and session data to iv18 for the purposes of account reconciliation, dispute resolution, and responsible gaming monitoring.

iv18 processes your personal data only where we have a clear, legitimate purpose for doing so. The table below sets out the primary purposes for which we use your data and the legal basis that justifies each use.

iv18 does not use your personal data for automated decision-making that produces significant legal effects on you, except where such processing is required for fraud detection or responsible gaming intervention, in which case you have the right to request human review of any automated decision that affects your account.

iv18 does not sell, rent, lease, or otherwise commercially transfer your personal data to third parties. We share your personal data only in the following limited and necessary circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive the minimum personal and financial data required to process your deposit or withdrawal transaction. Each processor operates under its own privacy policy and is bound by applicable data protection obligations.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified suppliers receive account-level session data to deliver game content, maintain game integrity, and provide dispute resolution support. No sensitive identity documents are shared with game providers.
• Identity verification services: Where a third-party KYC provider is engaged to verify the authenticity of documents you submit, that provider receives only the data needed to perform the verification and is contractually prohibited from using it for any other purpose.
• Fraud detection and security services: We may share technical and behavioural data with specialist fraud prevention partners to protect the Platform and its players from fraudulent activity, account takeovers, and money laundering.
• Legal and regulatory authorities: iv18 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or where iv18 reasonably believes disclosure is necessary to protect the legal rights, property, or safety of iv18, its players, or the public.
• Business successors: In the event of a merger, acquisition, restructuring, or sale of all or part of iv18's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

All third parties with whom iv18 shares personal data are required to process that data only for the stated purpose, to apply appropriate technical and organisational security measures, and to comply with applicable data protection laws. iv18 does not authorise any third-party processor to use your data for their own marketing or commercial purposes.

Because iv18 operates a real-money gaming platform, the handling of financial data and identity verification documentation is subject to additional care and scrutiny beyond standard personal data categories.

When you make a deposit or request a withdrawal, iv18 records the transaction amount (in BDT), the payment method used (e.g., bKash, Nagad, Rocket, Upay, bank transfer), the transaction reference number provided by the payment processor, the timestamp (Bangladesh Standard Time, UTC+6), and the resulting account balance change. This data is retained as part of your account transaction history and is used for reconciliation, dispute resolution, responsible gaming monitoring, and regulatory compliance.

iv18 operates a Know Your Customer (KYC) programme. KYC checks may be triggered at registration, upon your first withdrawal request, when cumulative deposits or withdrawals exceed specified thresholds, or at any time where iv18 has reasonable grounds to verify your identity. During a KYC check, you may be asked to submit one or more of the following:

• A clear photograph or scanned copy of a government-issued identity document (national ID card, passport, or driving licence)
• A recent proof of address document (utility bill, bank statement, or official letter dated within 3 months)
• Proof of ownership of the payment method you are using for deposits and withdrawals (e.g., a screenshot of your bKash or Nagad account showing your registered name and number)
• A selfie photograph for liveness verification, where required

KYC documents are stored securely using encryption at rest and are accessible only to iv18's compliance personnel. Documents submitted for KYC are retained for the period required by applicable anti-money laundering regulations and are not shared with any party other than the identity verification service provider engaged to authenticate them.

iv18 uses cookies and similar tracking technologies to operate the Platform, improve user experience, maintain session security, and analyse usage patterns. A cookie is a small text file placed on your device by your browser when you visit the Platform. Cookies do not contain executable code and cannot access files stored on your device outside the browser.

The following categories of cookies are used on the iv18 Platform:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account authentication state, and prevent fraudulent session hijacking. These cookies cannot be disabled without rendering the Platform non-functional.
• Functional cookies: These cookies remember your preferences — such as your preferred language (English), display settings, and last-visited game or betting market — to personalise your experience on return visits.
• Analytics cookies: These cookies collect anonymised data about how visitors interact with the Platform — including which pages are visited most frequently, how long sessions last, and where users navigate to and from. This data is used exclusively to improve the Platform's structure and content.
• Security cookies: These cookies assist in detecting and preventing fraudulent activity, bot traffic, and account abuse. They may record failed login attempts, unusual navigation patterns, or device fingerprint anomalies.

Most browsers allow you to control cookie settings through their privacy or settings menu. You may choose to block or delete cookies at any time; however, blocking strictly necessary cookies will prevent you from logging in or using real-money features of the Platform. iv18 does not use third-party advertising cookies or cross-site tracking cookies.

iv18 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• TLS 1.2 / TLS 1.3 SSL encryption for all data in transit between your device and the iv18 Platform
• AES-256 encryption for sensitive personal data stored at rest, including KYC documents and financial records
• Secure password hashing using industry-standard algorithms — iv18 never stores plaintext passwords
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Regular security audits and penetration testing of the Platform infrastructure
• Automated monitoring and alerting systems to detect unusual access patterns or potential data breaches in real time
• Multi-factor authentication requirements for internal staff accessing production systems containing player data

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, iv18 will notify affected players without undue delay and will take all reasonable steps to contain the breach, assess its impact, and prevent recurrence.

You also play a role in keeping your account secure. You are responsible for maintaining the confidentiality of your iv18 login credentials and for ensuring that you log out of your account on shared or public devices. If you suspect that your account has been accessed without your authorisation, contact [email protected] immediately.

iv18 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal and regulatory obligations. The following general retention periods apply:

When a retention period expires, data is either permanently deleted using secure erasure methods or anonymised so that it can no longer be linked to any identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis and platform improvement purposes.

Where you request deletion of your personal data under the rights described in Section 10 below, iv18 will delete or anonymise your data as promptly as possible, subject to any overriding legal obligation to retain specific records for the periods stated above.

As a player on the iv18 Platform, you hold the following rights in relation to your personal data. These rights may be exercised at any time by contacting [email protected]. iv18 will respond to all data rights requests within 2 business hours and will aim to resolve each request within 30 calendar days.

• Right of access: You may request a copy of all personal data that iv18 holds about you. We will provide this in a clear, structured format and confirm the purposes for which each category of data is being processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update certain account details directly through your iv18 account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where the processing has no other lawful basis. Note that iv18 may be required to retain certain data for legal compliance purposes as outlined in Section 9.
• Right to restriction: You may request that iv18 restrict the processing of your data — for example, while a dispute about data accuracy is being resolved — without deleting it entirely.
• Right to data portability: Where your data is processed on the basis of consent or contract, and is processed by automated means, you may request that iv18 provide your data in a structured, commonly used, machine-readable format for transfer to another service.
• Right to object: You may object to iv18's processing of your personal data where that processing is based on legitimate interests. iv18 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where iv18 processes your data on the basis of consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to human review of automated decisions: Where iv18 uses automated processing to make decisions that significantly affect your account — such as fraud flags or responsible gaming interventions — you have the right to request that a human member of iv18's compliance team review that decision.

iv18 is strictly an adults-only platform. Access to real-money gaming, sports betting, and all other services offered on the Platform is permitted only to individuals who are 21 years of age or older. iv18 does not knowingly collect, store, or process personal data belonging to any person under the age of 21.

During the registration process, all applicants are required to confirm their date of birth and agree that they are aged 21 or above. Where a KYC check reveals that a registered player is under the age of 21, iv18 will immediately suspend the account, void any pending transactions, and permanently delete all personal data associated with that account as swiftly as technically possible, subject only to any overriding legal obligation to retain records of the underage registration for compliance and reporting purposes.

If you are a parent or guardian and you believe that a minor under your care has registered an account on iv18, please contact [email protected] immediately. iv18 will investigate and act on all such reports with the highest priority. Please include as much detail as possible — including the account email address if known — to allow our compliance team to locate and close the account without delay.

iv18 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our Platform and services. The effective date at the top of this document will be updated whenever a material change is made.

Where a change to this Privacy Policy is material — meaning it significantly affects the way we collect, use, or share your personal data — iv18 will notify registered players via the email address associated with their account at least 14 days before the change takes effect. Non-material clarifications, corrections, or formatting updates may be made without advance notice.

Your continued use of the iv18 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must cease using the Platform and may request deletion of your account and associated personal data by contacting [email protected].

We encourage all players to review this Privacy Policy periodically to stay informed about how iv18 protects your personal data. The most current version of the Privacy Policy is always available at https://iv18.io/privacy-policy.