ssh8 Privacy Policy

1.1   ssh8 is Bangladesh's trusted online betting and casino platform, accessible at ssh8.io. We are committed to safeguarding the privacy and personal data of every player who registers and uses our platform. This commitment is not merely a legal obligation — it reflects our core belief that trust is the foundation of a sustainable player relationship.

1.2   This Policy applies to all personal data we process in connection with your use of the ssh8 platform, including data collected during account registration, identity verification, deposits and withdrawals, gameplay activity, customer support interactions, and your use of our website. It applies regardless of the device or method you use to access ssh8.io.

1.3   This Policy should be read alongside the ssh8 Terms & Conditions and the Responsible Gaming Policy, both of which are published on this website. Where those documents contain provisions relating to personal data, this Policy governs the data-protection aspects.

1.4   If you have any questions about this Policy or about how ssh8 handles your personal data, please contact our support team at [email protected]. We are committed to addressing all privacy enquiries in a timely and transparent manner.

2.1   For the purposes of this Policy, ssh8 acts as the data controller in respect of all personal data collected from players using the ssh8 platform. As data controller, ssh8 determines the purposes for which, and the means by which, your personal data is processed.

2.2   Where ssh8 engages third-party service providers — such as payment processors, identity verification providers, or platform security partners — those third parties may act as data processors on our behalf. In all such cases, ssh8 ensures that appropriate data-processing agreements are in place that bind those processors to confidentiality and data-protection obligations consistent with this Policy.

2.3   All data-protection queries, access requests, and erasure requests should be directed to ssh8 directly via [email protected]. See Section 9 (Your Rights) for the full procedure for submitting a data rights request.

3.1   ssh8 collects personal data from you in three principal ways: information you provide directly to us, information collected automatically when you use the platform, and information received from third-party service providers as part of our verification and payment processes.

3.2   The following table summarises the categories of personal data we collect and the context in which each category arises:

3.3   ssh8 does not collect any special category personal data (also known as sensitive personal data) such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, unless you volunteer such information in the course of a support interaction, in which case it is treated with the highest level of confidentiality and used solely for the purpose of resolving your query.

4.1   ssh8 uses the personal data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed here without first informing you and, where required, obtaining your consent.

• Account Creation and Management: To register your player account, verify your identity and age (21+ requirement), and maintain your account in good standing throughout your relationship with ssh8.
• Payment Processing: To process deposits made via bKash, Nagad, Rocket, or Upay, and to execute withdrawal requests to your verified personal mobile wallet. Financial data is shared with our payment processing partners solely to complete these transactions.
• Platform Operation: To deliver the betting and casino services you have requested, including displaying personalised bet histories, account balances, and game recommendations based on your activity on the platform.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multiple-account abuse, money laundering, and any other conduct prohibited under the ssh8 Terms & Conditions. This includes automated monitoring of transaction patterns and login behaviour.
• Responsible Gaming: To identify players who may be displaying signs of problem gambling — such as rapid loss escalation or unusually long session durations — and to apply responsible gaming interventions (e.g., deposit limit alerts, session reminders) in accordance with our Responsible Gaming Policy.
• Legal and Regulatory Compliance: To retain records as required by applicable laws, to respond to lawful requests from competent authorities, and to enforce our Terms & Conditions.
• Customer Support: To receive, investigate, and respond to support queries, complaints, and disputes raised by players through live chat or email.
• Platform Improvement: To analyse aggregated, anonymised usage data in order to improve the performance, usability, and game selection of the ssh8 platform. Individual players are not identified in these analytical processes.
• Promotional Communications: To send you bonus offers, promotional updates, and platform news where you have opted in to receive such communications. You may opt out of marketing communications at any time by contacting support at [email protected].

5.1   ssh8 processes your personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and ssh8 — specifically, to operate your account, process your bets, and execute payment transactions. Without this processing, we cannot provide the platform services you have requested.
• Legitimate Interests: Processing that is necessary for ssh8's legitimate interests in fraud prevention, platform security, abuse detection, and improving the quality of our services — provided that those interests are not overridden by your data-protection rights and interests.
• Legal Obligation: Processing that is required to comply with applicable legal requirements, including identity verification obligations, financial crime prevention requirements, and the retention of transaction records.
• Consent: Processing for optional purposes — primarily direct marketing communications — where ssh8 has obtained your explicit consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6.1   ssh8 may share your personal data with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Payment Processors (bKash, Nagad, Rocket, Upay): Your mobile wallet identifier and transaction amounts are shared with your chosen payment provider solely to process deposit and withdrawal requests. These providers are subject to their own privacy policies and applicable financial regulations.
• Identity Verification Partners: Where ssh8 uses a third-party provider to verify your identity documents (e.g., NID, passport), that provider receives the document image and extracted data solely for the purpose of completing verification. Verified data is not retained by the verification provider beyond the period necessary to complete the check.
• Platform Technology Providers: Providers of hosting infrastructure, content delivery networks, cybersecurity services, and analytics tools may process technical data (such as IP addresses and server logs) as part of maintaining and securing the platform. These providers act as data processors under appropriate contractual agreements.
• Competent Authorities: Where required by law or a lawful order from a competent government authority in Bangladesh, ssh8 may disclose personal data. In such cases, ssh8 will disclose only the minimum data necessary to comply with the legal obligation and will, where legally permissible, notify affected players of such disclosure.

6.2   ssh8 does not transfer personal data outside Bangladesh to any jurisdiction that does not provide an adequate level of data protection, except where strictly necessary and subject to appropriate contractual safeguards.

7.1   ssh8 uses cookies — small text files stored on your device by your browser — and similar tracking technologies (such as web beacons and local storage) on the ssh8.io website. These technologies are used to enable essential platform functions, improve security, and measure platform performance.

7.2   The following categories of cookies are used on ssh8.io:

• Strictly Necessary Cookies: Essential for the basic operation of the platform — including maintaining your login session, securing your account, and remembering your in-session preferences (such as odds format). These cookies cannot be disabled without impairing core platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised statistical data about how visitors interact with the ssh8 platform — such as which pages are visited most frequently, how long sessions last, and where errors occur. This data is aggregated and does not identify individual players. It is used exclusively to improve platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and account-takeover attacks. These cookies record signals such as device fingerprint, mouse movement patterns, and typing cadence solely for fraud-detection purposes.

7.3   ssh8 does not deploy third-party advertising or retargeting cookies. No cookie data from the ssh8 platform is shared with advertising networks or social media platforms.

7.4   You may manage or block cookies through your browser settings. Note, however, that disabling strictly necessary cookies will prevent you from logging in to your ssh8 account and accessing platform features. Disabling analytics cookies will not affect your ability to use the platform.

8.1   ssh8 retains personal data for as long as is necessary for the purpose for which it was collected, or as required to comply with applicable legal and regulatory obligations. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of your active account relationship with ssh8, and for a further period of five (5) years following account closure — to comply with financial crime prevention record-keeping requirements and to enable investigation of any post-closure dispute.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial record-keeping standards.
• Bet and Game History: Retained for a minimum of three (3) years from the date of each activity, and for the full duration of any open dispute involving that activity.
• Customer Support Communications: Retained for two (2) years from the date the support query was resolved, to enable reference in the event of a follow-up dispute.
• Technical and Usage Data (Cookies, Logs): Retained for up to thirteen (13) months from collection, after which it is automatically deleted or anonymised.
• Marketing Consent Records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, to evidence the consent history.

8.2   At the end of the applicable retention period, personal data is securely deleted or rendered permanently anonymous using industry-standard data destruction methods. Anonymous or aggregated data derived from your personal data may be retained indefinitely for platform analytics purposes, as it can no longer be used to identify you.

9.1   As a player on the ssh8 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact ssh8 at [email protected] with the subject line "Data Rights Request" and a description of the right you wish to exercise. We will respond within thirty (30) calendar days of receiving a valid request.

• Right of Access: You have the right to request a copy of the personal data that ssh8 holds about you, together with information about how it is used and with whom it has been shared.
• Right to Rectification: You have the right to request that ssh8 correct any inaccurate or incomplete personal data held about you. Corrections that affect your account's verified status (e.g., a name change) may require you to submit updated identity documentation.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data where ssh8 no longer has a lawful basis to retain it. Note that this right is subject to overriding legal obligations — for example, ssh8 is required to retain financial transaction records for the period described in Section 8, and this obligation takes precedence over an erasure request in respect of those records.
• Right to Restriction of Processing: You have the right to request that ssh8 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to ssh8 in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data on the basis of ssh8's legitimate interests. Where you object, ssh8 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent — primarily for marketing communications — you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

9.2   ssh8 will not charge a fee for handling a data rights request unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply. ssh8 reserves the right to refuse requests that are manifestly unfounded or excessive, and will inform you of the reason for refusal.

10.1   ssh8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• SSL/TLS Encryption in Transit: All communications between your device and the ssh8 servers are encrypted using industry-standard TLS protocols. This protects your login credentials, payment data, and personal information from interception during transmission.
• Encryption at Rest: Sensitive personal data — including identity documents, financial records, and account credentials — is stored in encrypted form on ssh8's servers. Encryption keys are managed through a dedicated key management system with strict access controls.
• Access Controls: Access to systems containing personal data is restricted to authorised ssh8 personnel with a legitimate operational need. Access privileges are reviewed regularly and revoked promptly when no longer required.
• Two-Factor Authentication (2FA): ssh8 supports two-factor authentication for player accounts to provide an additional layer of protection against unauthorised login. Players are strongly encouraged to enable 2FA in their account security settings.
• Penetration Testing and Vulnerability Scanning: The ssh8 platform is subject to regular independent security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ssh8 maintains a documented data breach response procedure. In the event of a confirmed breach that poses a significant risk to affected players, ssh8 will notify affected players without undue delay and take all reasonable steps to contain the breach and mitigate its impact.

10.2   While ssh8 employs stringent security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials. If you suspect that your account has been compromised, contact ssh8 support immediately at [email protected].

11.1   ssh8 takes the protection of minors extremely seriously. As part of our account registration process, we require all players to confirm that they are 21 years of age or older and to provide identity documentation that verifies their date of birth. Any account found to belong to a person under the age of 21 will be immediately closed, all funds will be dealt with in accordance with our legal obligations, and the matter may be reported to relevant authorities.

11.2   If you are a parent or guardian and believe that a person under the age of 21 has registered an account on the ssh8 platform using their personal information, please contact us immediately at [email protected]. We will investigate the matter promptly and take all necessary steps to close the account and delete the associated personal data.

12.1   ssh8 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or improvements to our platform. When material changes are made — changes that affect your rights or how your data is used in a significant way — ssh8 will notify you by publishing a prominent notice on the platform or by sending a notification to your registered contact details, at least seven (7) days before the updated Policy takes effect.

12.2   Minor updates — such as corrections of typographical errors or clarifications that do not alter the substance of the Policy — may be made without advance notice and will take effect upon publication at ssh8.io/privacy-policy.

12.3   The "Effective Date" shown at the top of this Policy and in the hero section above reflects the date on which the current version came into force. We encourage you to review this Policy periodically so that you remain informed about how ssh8 protects your personal data.

12.4   Your continued use of the ssh8 platform after a revised Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with a material change to the Policy, you should cease using the platform and request closure of your account before the change takes effect.

13.1   If you have any questions, concerns, or requests relating to this Privacy Policy or to the way ssh8 handles your personal data, please get in touch with our support team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, from within your logged-in ssh8 account dashboard
• Subject Line for Data Requests: Use "Data Rights Request" when emailing to ensure your query is routed to our data protection team without delay
• Response Time: Within one (1) hour during BST peak hours (08:00–22:00 BST); within four (4) hours at all other times; data rights requests responded to within thirty (30) calendar days

13.2   When submitting a data rights request, please include your full registered name and the mobile number associated with your ssh8 account so that we can locate your records and verify your identity before processing the request.

Last reviewed and updated: 1 January 2026. This Privacy Policy supersedes all previous versions.