Privacy Policy — How sforzy Protects Your Data

sforzy does not knowingly collect personal data from individuals under the age of 18. If we discover that an account has been created by a minor, that account will be immediately suspended, any funds returned to source, and all personal data associated with the account will be deleted from our systems within thirty (30) calendar days.

You are not obligated to provide all requested personal data; however, failure to provide data that is marked as mandatory during registration or KYC may mean that sforzy is unable to open or maintain your account, process withdrawals, or offer certain platform features.

sforzy processes personal data only for the specific, legitimate purposes described below. We do not use your data for any purpose that is incompatible with the reason for which it was originally collected, without first obtaining your explicit consent or being required to do so by applicable obligations.

• Account Creation and Management: To register your account, verify your identity, manage your account settings, process deposits and withdrawals in BDT via bKash, Nagad, Rocket, and Upay, and maintain an accurate record of your gaming activity and VIP tier status.
• Service Delivery: To provide access to casino games, sports betting markets, live dealer tables, crash games, and all other platform features available to registered players in Bangladesh.
• KYC and Fraud Prevention: To verify that you meet the minimum age requirement of 18 years, to confirm the ownership of payment accounts, to detect and prevent fraudulent activity, bonus abuse, money laundering, and other prohibited conduct described in our Terms & Conditions.
• Customer Support: To respond to your enquiries, resolve disputes, investigate complaints, and maintain records of communications for quality assurance and training purposes.
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling, to apply voluntary deposit limits and self-exclusion requests, and to send responsible gaming reminders where our systems identify risk indicators.
• Marketing and Promotions (Consent-Based): To send you information about deposit bonuses, free spin promotions, BPL and T20 cricket betting specials, VIP programme updates, and seasonal offers — but only where you have opted in to receive such communications. You may withdraw consent at any time.
• Platform Improvement: To analyse aggregated, anonymised data about how players navigate and interact with the platform, in order to improve usability, game selection, and overall player experience.
• Legal and Regulatory Compliance: To maintain records required under applicable financial and anti-money laundering obligations, to respond to lawful requests from competent authorities, and to enforce our Terms & Conditions.

sforzy will never use your personal data to make automated decisions that have a significant legal or similarly significant effect on you without a human review step and, where required, your prior consent.

Every data processing activity carried out by sforzy rests on one of the following lawful bases. Where the basis is consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

• Contractual Necessity: Processing your identity data, contact data, and financial data is necessary to enter into and perform the contract formed when you accept sforzy's Terms & Conditions and create an account. Without this processing, we cannot provide the services you have requested.
• Legitimate Interests: sforzy processes technical data, gaming activity data, and communications data where it is necessary for our legitimate interests — including fraud detection, platform security, responsible gaming monitoring, and improving our services — provided that these interests are not overridden by your own privacy rights.
• Legal Obligation: Processing KYC verification data and financial transaction records is required in order to comply with applicable anti-money laundering rules and financial record-keeping obligations. We are legally required to retain this data for the periods specified in Section 6 of this policy.
• Consent: Processing your contact data for direct marketing purposes, and placing non-essential cookies on your device, is carried out only on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time through your account notification settings or by contacting [email protected].

sforzy does not sell, rent, or trade your personal data. We share personal data with third parties only in the specific circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Service Providers: When you make a deposit or request a withdrawal, we share the transaction details necessary to process that payment with the relevant provider — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card networks (Visa, Mastercard). These providers process your financial data under their own privacy policies and security standards.
• Game Providers: To deliver casino games and live dealer experiences, your Account ID and session data are shared with the relevant certified Game Provider (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi) for the duration of a game session. Game Providers do not receive your full identity or financial data.
• KYC and Identity Verification Partners: Where sforzy uses a third-party identity verification service to assist with document authentication and liveness checks, your KYC documents may be processed by that provider on sforzy's behalf. Such providers are engaged under strict data processing agreements and may not use your data for their own independent purposes.
• Analytics and Platform Technology Providers: Aggregated, pseudonymised technical data may be processed by platform infrastructure and analytics providers who help sforzy maintain uptime, detect anomalies, and understand player behaviour at a statistical level. These providers act as data processors and are prohibited from using the data for their own commercial purposes.
• Competent Authorities: sforzy will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by a lawful order, warrant, or regulatory requirement. sforzy will notify affected players of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of sforzy's business assets, personal data held by sforzy may be transferred to the acquiring entity as part of that transaction. Affected players will be notified via email at least thirty (30) days before any such transfer takes effect.

All third parties with whom sforzy shares personal data are required to implement appropriate technical and organisational security measures and to process that data solely for the purposes for which it was shared.

You can manage your cookie preferences through the privacy settings panel available in your account dashboard after logging in. Withdrawing consent for optional cookies will not affect your ability to use the platform, though certain personalisation features may become unavailable. Strictly necessary and responsible gaming cookies cannot be disabled while you are logged in, as they are integral to account security and player welfare.

sforzy does not use third-party advertising cookies or allow external ad networks to place tracking cookies on the platform. All analytics and tracking tools used by sforzy operate under data processing agreements and are configured to pseudonymise data before transmission.

At the end of the applicable retention period, personal data is securely deleted or permanently anonymised using industry-standard data destruction methods. Anonymised data — from which it is no longer possible to identify any individual — may be retained indefinitely for statistical and research purposes. Deletion requests submitted by players (see Section 7) will be processed within the retention limits above; where a legal obligation requires that certain data be retained beyond the deletion request date, sforzy will inform you of the applicable period and the legal basis.

sforzy recognises that your personal data belongs to you and is committed to honouring the following rights in respect of the data we hold about you. To exercise any of these rights, please contact our support team via live chat within your account dashboard or by email at [email protected]. We will respond to all verified requests within thirty (30) calendar days.

• Right of Access: You may request a copy of all personal data that sforzy holds about you, together with information about the purposes for which it is processed, the categories of data involved, and any third parties with whom it has been shared. This is provided free of charge for one request per twelve-month period.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay. Where a correction would affect KYC-verified data, supporting documentation may be required.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing is otherwise unlawful. This right is subject to the retention obligations described in Section 6, and sforzy will inform you if any data must be retained beyond your deletion request date.
• Right to Restriction of Processing: You may request that sforzy restricts the processing of your data (i.e., retains it but does not actively use it) in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: You may request that sforzy provides your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), so that you may transfer it to another service provider. This right applies to data you have provided to us directly and that we process on the basis of your consent or contractual necessity.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes, and to processing based on sforzy's legitimate interests. Where you object to marketing, we will cease all marketing communications immediately. Where you object to legitimate-interest processing, we will carry out a balancing assessment and inform you of the outcome.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal date.

sforzy implements a layered approach to data security, combining technical safeguards, procedural controls, and ongoing monitoring to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. Our key security measures include the following:

• Transport Layer Security (TLS): All data transmitted between your browser or mobile device and sforzy's servers is encrypted using TLS 1.2 or higher. This prevents interception of login credentials, payment data, and personal account information during transmission.
• Encrypted Data Storage: Sensitive data fields — including password hashes, identity document files, and financial account identifiers — are stored using strong encryption algorithms. Passwords are never stored in plain text; they are hashed using a modern, salted hashing algorithm.
• Access Controls: Access to personal data within sforzy's internal systems is restricted to employees and contractors who have a documented need to access it for their job function. All internal access is logged and subject to regular audit. sforzy staff are trained on data protection responsibilities as part of their onboarding and annual compliance refresher.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their sforzy accounts for an additional layer of login security. sforzy's own internal administrative systems require 2FA for all personnel who have access to player data.
• Fraud and Anomaly Detection: sforzy operates real-time monitoring systems that flag unusual login activity, suspicious transaction patterns, and potential account takeover attempts. Automated alerts trigger security reviews without delay when anomalies are detected.
• Data Breach Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, sforzy will notify affected players by email at the address registered to their account within seventy-two (72) hours of becoming aware of the breach, and will take immediate remedial action to contain and investigate the incident.
• Third-Party Security Standards: All payment processors, KYC verification partners, and Game Providers who handle player data on sforzy's behalf are required to demonstrate compliance with recognised information security standards, including PCI DSS compliance for any party handling card payment data.

Despite these measures, no system connected to the internet is entirely free from risk. sforzy cannot guarantee the absolute security of data in transmission or storage, and players are responsible for maintaining the security of their own account credentials and devices. If you suspect that your account has been compromised, please contact our support team immediately at [email protected] so that protective action can be taken without delay.