Privacy Policy — sona103
At sona103, your privacy is a foundational commitment, not an afterthought. This Privacy Policy sets out in clear, formal terms exactly what personal data we collect from Bangladesh-based players, the lawful bases on which we process it, how we protect it, and the rights you hold over your own information at every stage of your relationship with our platform.
Our Privacy Commitments
Six Principles That Guide How We Handle Your Data
Data collected on sona103 is used only for the purposes stated in this Policy. We do not repurpose your personal information for unrelated commercial objectives without your explicit consent.
We collect only the minimum amount of personal data necessary to operate your sona103 account, process transactions in BDT, and meet our compliance obligations under applicable law.
All personal data stored by sona103 is protected with industry-standard SSL/TLS encryption in transit and AES-256 encryption at rest. Access is restricted to authorised personnel on a strict need-to-know basis.
Registered players hold enforceable rights over their personal data, including the right to access, correct, or request deletion of their information. All such requests are handled within 30 days of receipt.
sona103 does not sell, rent, or trade your personal information to third-party marketers. Data shared with service providers is governed by strict contractual data processing agreements.
Whenever sona103 makes a material change to this Privacy Policy, we will notify registered players by email and update the effective date shown at the top of this document before the change takes effect.
This Privacy Policy ("Policy") applies to all users who access, register, or transact on the sona103 website and platform ("the Platform", "we", "us"). It describes how sona103 collects, processes, stores, shares, and protects personal data provided by players based in Bangladesh. By creating an account or continuing to use the Platform, you acknowledge that you have read this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you should discontinue use of sona103 and contact our support team to request account closure.
sona103 is committed to handling your personal data responsibly and in accordance with applicable data protection principles. This Policy is written in plain English and structured to give you a clear, section-by-section understanding of our data practices. Where legal or technical language is unavoidable, we have provided explanatory context immediately alongside it.
01 Information We Collect
sona103 collects personal data through several channels during the course of your relationship with the Platform. The categories of data we collect, and the specific circumstances in which each category is gathered, are described below.
1.1 Registration Data
When you create a sona103 account, you are required to provide the following information:
- Full legal name as it appears on your government-issued identification document.
- Date of birth, for the purpose of verifying that you meet the minimum age requirement of 18 years.
- Residential address in Bangladesh, including division, district, and postal code.
- A valid email address that will serve as your primary communication channel with sona103.
- A mobile phone number associated with your bKash, Nagad, or other registered payment account.
- A username and password of your choosing, which you are responsible for keeping confidential.
1.2 KYC and Identity Verification Data
At the point of first withdrawal, or when your cumulative deposit activity exceeds certain thresholds, sona103 will request Know Your Customer (KYC) documentation. This may include:
- A scanned copy or clear photograph of your Bangladesh National Identity Card (NID), passport, or driving licence.
- A proof-of-address document such as a utility bill, bank statement, or government letter dated within the past three months.
- Confirmation of ownership of any payment account (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa, or Mastercard) used to deposit funds on the Platform.
All KYC documents are stored in encrypted form and accessed only by our compliance team on a strictly need-to-know basis.
1.3 Transaction and Financial Data
sona103 records all financial activity conducted through your account, including deposit amounts, withdrawal requests, bonus credits and debits, wagering history, and any refunds or reversals. Transaction records are denominated in Bangladeshi Taka (৳ BDT) and retained for the periods specified in Section 6 of this Policy.
1.4 Technical and Device Data
When you access sona103 from any device, our systems automatically collect certain technical data, including:
- IP address and approximate geographic location derived from it.
- Device type, operating system, and browser version.
- Session timestamps, page views, and in-platform navigation patterns.
- Unique device identifiers where available.
This technical data is used primarily for fraud prevention, platform security, and aggregate analytics. It is not used to build individual marketing profiles without your separate consent.
1.5 Communication Data
When you contact sona103 via live chat, email, or any other support channel, we retain records of those communications — including your messages, our responses, and any attachments you provide — for quality assurance, dispute resolution, and regulatory compliance purposes.
Data you choose not to provide: Providing registration data is a condition of creating a sona103 account. KYC documentation is a condition of processing withdrawals. You may choose not to provide optional profile information, but this will not affect your ability to access the Platform's core features.
02 Lawful Basis for Processing
sona103 processes personal data only where a valid lawful basis exists for doing so. The table below summarises the primary processing activities and the corresponding lawful basis applied in each case.
| Processing Activity | Lawful Basis |
|---|---|
| Creating and managing your player account | Performance of a contract (account agreement between you and sona103) |
| Processing deposits and withdrawal requests in BDT | Performance of a contract; compliance with payment processing obligations |
| KYC identity and age verification | Legal obligation (anti-money laundering compliance; age verification requirements) |
| Fraud detection, security monitoring, and anti-abuse measures | Legitimate interests of sona103 in protecting the integrity of the Platform |
| Sending transactional communications (deposit confirmations, withdrawal updates) | Performance of a contract |
| Sending promotional emails and bonus offers | Consent (you may withdraw consent at any time via your account settings) |
| Retention of financial and transaction records | Legal obligation (record-keeping requirements) |
| Responsible gaming monitoring and intervention | Legitimate interests; legal obligation where applicable |
03 How We Use Your Data
The personal data collected by sona103 is used for the following purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or being required to do so by law.
3.1 Account and Platform Operations
We use your registration and identity data to create and maintain your player account, authenticate your identity at login, process deposits and withdrawals in BDT through your chosen payment method (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa, or Mastercard), enforce the one-account-per-player rule, and apply bonus credits and wagering requirements correctly to your account balance.
3.2 Fraud Prevention and Platform Security
Technical data — including your IP address, device identifiers, and session patterns — is analysed by our automated security systems and, where flagged, reviewed by our compliance team, to detect and prevent account takeover attempts, multi-accounting, bonus abuse, money laundering, and other fraudulent activity. This processing is essential to the safe operation of sona103 and to protecting all players on the Platform.
3.3 Responsible Gaming
sona103 uses your wagering history, session duration, deposit frequency, and account activity data to monitor for indicators of problem gambling behaviour. Where our responsible gaming algorithms identify a potential concern, we may proactively contact you with information about our self-exclusion and deposit limit tools. This processing is conducted in accordance with our Responsible Gaming policy and is in the legitimate interests of player welfare.
3.4 Customer Support and Dispute Resolution
Communication records and account history data are used by our support team to investigate and resolve disputes, respond to your enquiries, and improve the quality of our customer service. Support communications are retained for a minimum of three years to support any future dispute or regulatory enquiry.
3.5 Marketing and Promotional Communications
Where you have provided consent, sona103 may send you promotional emails and in-platform notifications about new games, seasonal promotions (such as Eid, Pohela Boishakh, or Victory Day special offers), reload bonuses, and VIP programme updates. You may withdraw your marketing consent at any time by updating your communication preferences in your account settings or by emailing support@sona103. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to withdrawal.
No profiling for third-party advertising: sona103 does not share your personal data with third-party advertising networks or use your data to serve targeted advertisements on external websites or applications. Any profiling conducted on the Platform is limited to personalising your sona103 experience and is not shared beyond the Platform ecosystem.
04 Cookies and Tracking Technologies
sona103 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your login session, to remember your preferences, and to gather aggregate analytics data that helps us improve the player experience.
4.1 Types of Cookies Used
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Functional | Maintain your login session, remember account preferences, enable Platform navigation, and support secure transaction processing. | Session or up to 30 days |
| Analytics | Collect anonymised and aggregated data on page views, session durations, and feature usage to help sona103 improve Platform performance and content. | Up to 12 months |
| Security | Detect and prevent fraudulent login attempts, bot activity, and cross-site request forgery (CSRF) attacks. | Session |
| Preference | Remember your language, display, and notification preferences across sessions. | Up to 12 months |
4.2 Managing Cookies
Essential and security cookies are strictly necessary for the Platform to function and cannot be disabled without significantly impairing your ability to use sona103. Analytics and preference cookies may be disabled through your browser's cookie settings. Please note that disabling certain cookies may affect the functionality of some Platform features. Detailed instructions for managing cookies in the most common browsers are available from the respective browser's official help documentation.
4.3 No Third-Party Advertising Cookies
sona103 does not deploy third-party advertising or retargeting cookies. We do not allow external advertising networks to place cookies on your device through the sona103 Platform.
05 Data Sharing and Third Parties
sona103 does not sell, rent, or trade your personal data. We share your information only in the limited circumstances described below, and only to the extent necessary for the specific purpose stated.
5.1 Payment Processors
To process your BDT deposits and withdrawals, sona103 shares relevant transaction data with your chosen payment provider — which may include bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa, or Mastercard. The data shared is limited to what is technically required to initiate and confirm the transaction. Each payment provider operates under its own privacy policy and data protection standards, which we recommend you review.
5.2 Game Studio Providers
sona103 delivers casino games through certified third-party studio providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These studios receive session-level game interaction data (game type, bet amount, outcome) necessary for game delivery and RNG certification. They do not receive your full identity or payment data.
5.3 Compliance and Legal Obligations
sona103 may be required by law, court order, or regulatory direction to disclose certain player data to competent authorities. In such cases, we will disclose only the minimum data required to satisfy the legal obligation and, where permitted by law, will notify the affected player of the disclosure request. Where we receive a demand that we believe to be unlawful or overly broad, we will challenge it through appropriate legal channels before complying.
5.4 Service Providers and Data Processors
sona103 engages a limited number of third-party service providers — such as cloud infrastructure providers, email delivery services, and fraud detection software vendors — who process data on our behalf under written Data Processing Agreements (DPAs). These agreements require service providers to implement appropriate technical and organisational security measures, process data only on our documented instructions, and delete or return all personal data upon termination of the service relationship.
No international transfers to high-risk jurisdictions: sona103 does not transfer your personal data to jurisdictions that lack adequate data protection standards without first implementing appropriate safeguards such as contractual clauses or equivalent protective measures.
06 Data Retention Periods
sona103 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the primary categories of data we hold.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | Anti-money laundering record-keeping obligations |
| KYC identity documents | Duration of account + 5 years after closure | Regulatory compliance; fraud investigation |
| Transaction and financial records | Duration of account + 7 years after closure | Financial record-keeping requirements |
| Support communications | 3 years from date of communication | Dispute resolution; quality assurance |
| Session and device logs | 12 months from date of generation | Security monitoring; fraud detection |
| Marketing consent records | Until consent is withdrawn + 3 years | Evidence of consent; regulatory compliance |
| Responsible gaming records | Duration of account + 5 years after closure | Player welfare obligations; regulatory audit trail |
Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised in accordance with sona103's data disposal procedures. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business analytics purposes.
07 Your Privacy Rights
As a registered player on sona103, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, please submit a written request to support@sona103 from the email address associated with your sona103 account. We will respond within 30 calendar days of receiving a valid request.
7.1 Right of Access
You have the right to request a copy of all personal data that sona103 holds about you, together with information about how it is being used, the categories of recipients with whom it has been shared, and the retention period applicable to it. We will provide this information in a structured, commonly used electronic format.
7.2 Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented without undue delay. For certain data fields — such as your name and date of birth — rectification requests require supporting documentation to ensure that our records accurately reflect verified information.
7.3 Right to Erasure
You may request that sona103 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other lawful basis exists, or where the data has been processed unlawfully. Please note that this right is subject to exceptions: sona103 may be legally required to retain certain data for the periods described in Section 6, and in such cases an erasure request cannot be fully honoured until the mandatory retention period has elapsed.
7.4 Right to Restriction of Processing
You may request that sona103 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing based on legitimate interests and we are considering whether our interests override yours.
7.5 Right to Data Portability
Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive the personal data you have provided to sona103 in a structured, machine-readable format, and to request that we transmit that data directly to another service provider where technically feasible.
7.6 Right to Object
You have the right to object to the processing of your personal data where sona103 relies on legitimate interests as the lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims. You may withdraw your consent to marketing communications at any time without this affecting other processing activities.
Response timelines: sona103 will acknowledge all data rights requests within 5 business days of receipt and provide a substantive response within 30 calendar days. Where the complexity or volume of a request requires additional time, we will notify you within the initial 30-day period and provide an extended response deadline of no more than 60 days from the original request date.
08 Security Measures
sona103 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. While no online platform can guarantee absolute security, sona103's security programme reflects current industry best practices for the online gaming sector.
8.1 Encryption
All data transmitted between your device and the sona103 platform is encrypted using Transport Layer Security (TLS 1.2 or higher). Personal and financial data stored in our systems is encrypted at rest using AES-256 encryption. Database access credentials are rotated regularly and stored in a dedicated secrets management system with no direct human-readable access.
8.2 Access Controls
Access to systems that contain personal data is governed by role-based access controls (RBAC). Each member of the sona103 team is granted access only to the data necessary for their specific role. All administrative access is logged, and logs are reviewed regularly by our security team. Multi-factor authentication is required for all staff accessing production systems.
8.3 Incident Response
sona103 maintains a documented data breach response procedure. In the event of a security incident that is likely to result in a risk to the rights and freedoms of affected players, sona103 will notify the affected players without undue delay and, where required, report the incident to the relevant regulatory authority within the timeframe prescribed by applicable law.
8.4 Player-Side Security Responsibilities
The security of your sona103 account also depends on the measures you take on your own side. You are responsible for choosing a strong, unique password for your account, not sharing your credentials with any third party, logging out of your account when using a shared or public device, and promptly reporting any suspected unauthorised access to support@sona103. sona103 will never ask you for your password through any communication channel.
Responsible disclosure: If you discover a security vulnerability on the sona103 platform, please report it responsibly to support@sona103. We take all such reports seriously and will investigate promptly. We will not pursue legal action against researchers who report vulnerabilities in good faith and refrain from exploiting them.
8.5 Policy Updates
sona103 reviews this Privacy Policy at least annually and whenever a material change in our data practices occurs. The effective date shown at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically. Material changes will be communicated to registered players via email to the address on file at least 14 days before the updated Policy takes effect, giving you an opportunity to review the changes and, if you do not agree, close your account before the new Policy applies to you.
For any questions, concerns, or requests relating to this Privacy Policy or the data sona103 holds about you, please contact our support team. All privacy-related correspondence should be submitted in writing to support@sona103 with the subject line "Privacy Request — [Your Account Username]".
Have Questions About Your Data?
Our support team is available around the clock to address any privacy-related enquiries. You can also explore our full FAQ, review our Responsible Gaming guidelines, or head to the casino floor — we keep your data safe every step of the way. 18+ only.