Privacy Policy — Your Data, Our Responsibility

sona1 ("sona1", "we", "us", "the Platform") is committed to protecting the personal data of every individual who registers and plays on our online casino and sports betting platform. This Privacy Policy sets out a clear and complete account of how sona1 collects, processes, stores, shares, and protects your personal information when you use the services available at sona1.bio.

sona1 operates with full awareness that our players are real people with a genuine interest in knowing how their data is handled. We have written this Policy in plain English so that every player across Bangladesh — whether you are in Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, or anywhere else — can understand exactly what happens to your data without needing specialist legal knowledge.

This Policy should be read alongside sona1's Terms & Conditions, which together form the complete legal framework governing your relationship with the Platform. Capitalised terms not defined in this Policy carry the meanings assigned to them in the Terms & Conditions.

sona1 collects personal data in several categories, depending on the nature of your interaction with the Platform. The following table summarises the data types we collect and their purpose:

sona1 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly necessary for identity verification purposes.

sona1 collects personal data through the following channels:

• Direct Submission: Data you provide directly when completing the registration form, updating your account profile, submitting identity verification documents, contacting customer support, or participating in promotions.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, browser and device information, session timestamps, and click-path data. This data is collected via server logs and analytics tools.
• Cookies and Similar Technologies: Data collected via cookies, web beacons, and similar tracking technologies as described in Section 7 of this Policy.
• Payment Providers: Transaction confirmation data received from our payment partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard) when you make a deposit or withdrawal. sona1 receives only the data necessary to reconcile and confirm the transaction — we do not receive your full payment credentials.
• Third-Party Verification Services: Data received from identity verification and age-check service providers where we use such services to supplement the documents you provide directly.
• Game Software Providers: Session and gaming outcome data received from our game technology providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, for the purpose of recording your gaming history and processing settlements.

sona1 uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, and administering your sona1 player account, including processing account updates and handling account closure requests.
• Identity and Age Verification: Verifying that you are at least 21 years of age and confirming that the details you provide are accurate and genuine, as required for responsible gaming and regulatory compliance.
• Payment Processing: Processing your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and maintaining accurate records of all financial transactions associated with your account.
• Service Delivery: Providing access to our full library of casino games and sports betting markets, personalising your gaming experience, and delivering bonus offers and promotions you are eligible for.
• Responsible Gaming: Monitoring gaming patterns for indicators of problem gambling, enforcing deposit limits and self-exclusion restrictions you have set, and proactively reaching out where we have welfare concerns about your gaming behaviour.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Legal and Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) regulations, responding to lawful requests from competent authorities, and maintaining records as required by law.
• Customer Support: Responding to your enquiries, resolving complaints, and improving our support quality based on interaction history.
• Marketing Communications: Sending you promotional emails and notifications about relevant sona1 offers, including BPL and IPL cricket betting promotions, Eid and Pohela Boishakh seasonal bonuses, and new game releases — but only where you have opted in to receive such communications. You may withdraw this consent at any time.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, payment processing efficiency, and the overall player experience.

sona1 processes your personal data only where a valid legal basis exists. The legal bases we rely on are:

• Contractual Necessity: Processing that is necessary to perform the contract between you and sona1 — i.e., to operate your account, process payments, and deliver the gaming services you have registered to use.
• Legal Obligation: Processing that is required for sona1 to comply with applicable legal requirements, including anti-money laundering obligations, age verification requirements, and financial record-keeping duties.
• Legitimate Interests: Processing that is necessary for sona1's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. Where consent is the basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

sona1 does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances, and only to the extent strictly necessary for each purpose:

• Payment Service Providers: We share transaction data with bKash, Nagad, Rocket, Upay, Visa, and Mastercard solely to process your deposits and withdrawals. Each payment provider operates under its own privacy policy and data protection obligations.
• Game Technology Providers: We share account identifiers and session data with our game software partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) to authenticate your access to their games and to record gaming outcomes in your account.
• Identity Verification Partners: We may share identity documents and verification data with third-party KYC (Know Your Customer) service providers to conduct age and identity checks, where we use such services.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement, financial intelligence units, or other competent authorities where required to do so by law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Professional Advisors: We may share data with legal counsel, auditors, or other professional advisors where necessary for legitimate business and compliance purposes, subject to strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of sona1's assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments. Players will be notified of any such transfer that materially affects the terms of this Policy.

All third parties with whom sona1 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the specified purposes.

sona1 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as account login session management, security token validation, and payment flow continuity. These cookies cannot be disabled without impairing your ability to use the Platform.
• Performance and Analytics Cookies: These cookies collect aggregated, anonymised data about how players navigate the Platform — including which pages are visited most frequently, session duration, and error occurrences. This data helps sona1 identify areas for improvement.
• Functional Cookies: These cookies remember your preferences and settings — such as your last selected game category, preferred language display, and responsible gaming tool configurations — so that you do not need to re-enter them on each visit.
• Security Cookies: These cookies support our fraud detection and anti-bot systems by tracking unusual access patterns and verifying that interactions on the Platform originate from legitimate human users.

sona1 does not use third-party advertising cookies or cross-site tracking cookies. Your gaming activity on sona1 is not shared with advertising networks for the purpose of behavioural advertising.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. Disabling performance or functional cookies will not prevent you from playing, but may reduce the quality of your experience.

sona1 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and sona1 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all platform functions including login, deposit, withdrawal, and account management.
• Password Security: Account passwords are stored as secure, salted cryptographic hashes using a modern hashing algorithm. Passwords are never stored in readable form and are not accessible to sona1 staff.
• Access Controls: Access to personal data within sona1's internal systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific role, and all access is logged and audited.
• Infrastructure Security: sona1's platform infrastructure is hosted in secure data centre environments with physical access controls, redundant network architecture, intrusion detection systems, and regular security patching.
• Fraud Detection Systems: Automated systems continuously monitor for suspicious activity patterns — including unusual login locations, rapid deposit-withdrawal sequences, and multi-accounting indicators — and trigger alerts for human review.
• Regular Security Reviews: sona1 conducts periodic internal security assessments and engages with independent security specialists to review and strengthen our data protection posture on a continuous basis.

sona1 retains personal data for as long as is necessary for the purpose for which it was collected, subject to any legal obligations that require us to keep records for a defined minimum period. Our retention principles are:

• Active Accounts: Personal data associated with an active sona1 account is retained for the duration of the account's active status, plus any legally mandated retention period following account closure.
• Financial Records: Transaction records, deposit and withdrawal histories, and associated financial data are retained for a minimum of five (5) years following the date of each transaction, in accordance with standard financial record-keeping practices and AML compliance requirements.
• Identity Verification Documents: Copies of NID, passport, and other verification documents are retained for the duration of your account relationship plus a minimum of five (5) years following account closure.
• Support Communications: Customer support chat transcripts and email correspondence are retained for a minimum of two (2) years from the date of each interaction, for dispute resolution and service quality purposes.
• Marketing Data: Where you have opted in to marketing communications, your marketing preferences and associated contact data are retained until you withdraw your consent, at which point your details are removed from marketing distribution lists within five (5) business days.
• Self-Excluded Players: Records relating to self-excluded players are retained for the full duration of the self-exclusion period to prevent re-registration, and for an additional five (5) years thereafter.

Once the applicable retention period has expired, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

As a sona1 player, you have the following rights in relation to your personal data. These rights apply regardless of whether you are accessing the Platform from Dhaka, Chittagong, Sylhet, or elsewhere in Bangladesh:

• Right of Access: You have the right to request a copy of the personal data sona1 holds about you. We will provide this information within thirty (30) calendar days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account details directly from your account settings dashboard.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal obligations to retain certain records.
• Right to Restrict Processing: You have the right to request that sona1 restricts the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where sona1 is relying on legitimate interests as the legal basis, or where data is being processed for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of the above rights, please contact the sona1 support team via live chat or email at [email protected]. We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) calendar days. In exceptional cases of complexity, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it.

The sona1 platform is strictly intended for adults aged 21 years and above. sona1 does not knowingly collect, process, or retain any personal data from individuals under the age of 21. The Platform employs multiple layers of age verification to prevent underage access, including age declaration at registration, mandatory identity document verification, and ongoing monitoring.

If sona1 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete all personal data collected, void any associated balance, and take appropriate steps to prevent future access by that individual.

If you are a parent or guardian and believe that a minor in your care has registered on sona1, please contact our support team immediately at [email protected]. We will investigate and act upon all such reports as a matter of priority. Parental controls and open communication about gambling risks are strongly encouraged to prevent underage access to online gaming platforms.

The sona1 platform integrates with a number of third-party service providers to deliver a complete gaming experience. While sona1 carefully selects partners who maintain high data protection standards, each third-party provider operates under its own privacy policy, and sona1 is not responsible for the data practices of third parties beyond the data-sharing agreements we hold with them.

The third-party services integrated into sona1 include:

• Game Software Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi — these providers may process session data necessary to operate their games within the sona1 platform.
• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard — these providers process payment data in accordance with their own published privacy policies and applicable financial regulations.
• Analytics Tools: sona1 uses privacy-compliant web analytics tools to measure platform performance. Analytics data is collected in anonymised or pseudonymised form and is not used to identify individual players.

sona1 does not embed third-party social media plugins, advertising networks, or cross-site trackers on the Platform. Players are not tracked across external websites as a result of using sona1.

sona1 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable legal requirements, or the services we offer. The most current version of this Policy will always be available at sona1.bio/privacy-policy, and the "last updated" date at the top of the Policy will be revised accordingly.

Where changes to this Policy are material — meaning they significantly affect how your personal data is collected, used, or shared — sona1 will notify registered players via email and/or an on-platform notification at least seven (7) days before the changes take effect, where practicable.

Minor updates such as typographical corrections, clarifications that do not alter the substantive meaning of any provision, or updates to reflect changes in third-party partner names may be made without prior notice. Your continued use of the Platform after any update to this Policy constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a data protection concern, please contact the sona1 support team through any of the following channels:

• Email: [email protected] — plain text, not a clickable link
• Live Chat: Available 24 hours a day, 7 days a week, directly within the sona1 platform
• WhatsApp: +880 1700 000000 — plain text, not a clickable link
• Support Hours: Bangladesh Standard Time (BST, UTC+6), 24/7

All privacy-related enquiries are handled by sona1's dedicated support team. We aim to acknowledge all data rights requests within five (5) business days and to resolve them within thirty (30) calendar days. If you are not satisfied with sona1's response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority.