sat20 Privacy Policy — Your Data, Protected at Every Step

This Privacy Policy ("Policy") sets out the basis on which sat20 ("sat20", "Platform", "we", "us", "our") collects, processes, stores, and discloses personal data obtained from individuals ("User", "Player", "you") who access or use the sat20 website at https://sat20.io and all associated services, games, and features (collectively, the "Platform").

sat20 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy should be read together with sat20's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference.

By registering an account, completing the sat20 Login process, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not accept the terms of this Policy, you must cease using the Platform immediately.

For the purposes of this Policy, sat20 acts as the data controller in respect of personal data collected from players who register and use the Platform. As data controller, sat20 determines the purposes and means by which your personal data is processed.

All data-related enquiries, rights requests, and formal complaints regarding sat20's data processing practices should be directed to the sat20 Data Protection contact at:

• Email: support@sat20.io
• Subject line for data requests: "Data Protection Request — [Nature of Request]"
• Response time: sat20 will acknowledge all data rights requests within five (5) business days and will provide a substantive response within thirty (30) calendar days of receipt.

sat20 collects personal data in the following categories. The specific data points collected may vary depending on the services you use and the level of KYC verification required in connection with your account activity.

sat20 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond facial photograph for identity verification), or health data, unless this is expressly required to fulfill a specific regulatory obligation and you have been separately informed of that collection.

sat20 obtains personal data through the following channels:

• Direct provision by you: Data you supply during account registration, KYC document submission, deposit and withdrawal requests, contact with customer support, and any other direct interaction with the Platform following a sat20 Login.
• Automated technical collection: Data collected automatically through cookies, web server logs, and analytics tools when you access or interact with the sat20 website. See Section 9 (Cookies & Tracking) for further detail.
• Third-party KYC verification partners: Where sat20 uses a third-party identity verification service to validate documents you have submitted, that provider may return additional data points to sat20 as part of the verification result (e.g., document authenticity status, facial match confidence score).
• Payment providers: bKash, Nagad, Rocket, and Upay may transmit transactional confirmation data to sat20 in connection with deposit and withdrawal processing. sat20 receives only the data necessary to record and reconcile your transactions.
• Fraud and risk screening services: sat20 may receive data from third-party fraud prevention or sanctions screening services to fulfil its anti-money-laundering obligations. This data is used solely for compliance purposes.

sat20 processes your personal data only where a valid legal basis exists for doing so. The following table sets out the primary purposes of processing and the corresponding legal basis for each:

Where sat20 relies on legitimate interest as the legal basis for processing, it has conducted a balancing assessment confirming that its legitimate interest is not overridden by your interests, rights, or freedoms. You may request details of any such assessment by contacting support@sat20.io.

sat20 does not sell your personal data. Data may be shared with the following categories of third party, strictly on a need-to-know basis and solely for the purposes described in this Policy:

• KYC and identity verification providers: To verify your identity and age as part of the mandatory KYC process. These providers process your identity documents and return a verification result to sat20.
• Payment processors (bKash, Nagad, Rocket, Upay): To facilitate deposit and withdrawal transactions. sat20 shares only the data necessary to initiate and reconcile transactions with your registered payment account.
• Game content providers (including Evolution Gaming, Ezugi, Pragmatic Play, Spribe, Microgaming, NetEnt): Where required by the game software to deliver the game session, a limited set of session-specific data (such as player session token and wager data) may be passed to the game provider's system. Personal identity data is not shared with game providers.
• Fraud prevention and sanctions screening services: To comply with anti-money-laundering obligations and to protect the Platform from financial crime.
• IT infrastructure and cloud hosting providers: sat20 uses third-party server and hosting infrastructure to operate the Platform. These providers act as data processors and are contractually prohibited from using your data for any purpose other than providing infrastructure services to sat20.
• Legal and regulatory authorities: sat20 may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or in connection with the investigation of suspected illegal activity.

All third-party processors engaged by sat20 are subject to written data processing agreements that require them to maintain security standards consistent with sat20's obligations and to process your personal data solely on sat20's documented instructions.

sat20 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of the account's active life plus a minimum of five (5) years following account closure or the last recorded sat20 Login, to comply with anti-money-laundering record-keeping obligations.
• Financial transaction data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial record-keeping requirements.
• Gaming activity data: Retained for a minimum of three (3) years from the date of each game session, for responsible gaming monitoring, dispute resolution, and audit purposes.
• Customer support communications: Retained for two (2) years from the date of the last communication in a support thread, unless the content relates to an ongoing dispute or legal proceeding, in which case it is retained until the matter is fully resolved.
• Technical and usage data (cookies, logs): Retained for up to thirteen (13) months from the date of collection, unless longer retention is required for security investigation purposes.
• Marketing consent records: Retained for the duration of your marketing consent plus three (3) years thereafter, as evidence of consent in the event of a complaint.

Upon expiry of the applicable retention period, sat20 will securely delete or irreversibly anonymise the relevant personal data. Anonymised data that can no longer be linked to any individual may be retained indefinitely for statistical and analytical purposes.

sat20 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the sat20 Platform is encrypted using TLS 1.2 or higher. All pages — including the sat20 Login page and the cashier — are served exclusively over HTTPS.
• Encryption at rest: Sensitive personal data stored in sat20's databases is encrypted at rest using AES-256 encryption.
• Password security: Account passwords are stored as salted cryptographic hashes and are never held in plaintext by sat20. sat20 support staff cannot view your password and will never ask you to share it.
• Access controls: Access to personal data within sat20's systems is restricted to authorised personnel whose job role requires that access. All access is logged and subject to periodic review.
• Two-factor authentication: sat20 offers optional two-factor authentication (2FA) on the sat20 Login process to provide an additional layer of account security. Players are strongly encouraged to enable 2FA.
• Penetration testing and security audits: sat20's technical infrastructure is subject to periodic independent security assessments to identify and remediate vulnerabilities.
• Incident response: sat20 maintains a documented data breach response procedure. In the event of a breach that presents a high risk to your rights and freedoms, sat20 will notify affected players without undue delay.

sat20 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your logged-in session after a sat20 Login, and analyse how the Platform is used. The following categories of cookies are deployed:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable core features such as maintaining your authenticated session after a sat20 Login, storing your cart state, and preventing cross-site request forgery. These cookies cannot be disabled without materially impairing Platform functionality.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming tool configurations — to personalise your experience on subsequent visits.
• Analytics cookies: These cookies collect aggregated, anonymised data about how players navigate the Platform, which pages are visited most frequently, and where users encounter difficulties. This data is used solely to improve Platform performance and user experience.
• Security cookies: These cookies assist in detecting and preventing fraudulent activity, account takeover attempts, and unusual login patterns. They are a component of sat20's security infrastructure.

sat20 does not deploy third-party advertising or behavioural tracking cookies that share your data with external advertising networks or data brokers.

You may control cookie settings through your browser's privacy settings. Please note that disabling strictly necessary cookies will prevent you from completing the sat20 Login process and using core Platform features.

As a player whose personal data is processed by sat20, you hold the following rights in respect of your personal data. To exercise any of these rights, submit a written request to support@sat20.io with the subject line "Data Rights Request — [Right Being Exercised]".

• Right of access: You have the right to request a copy of the personal data sat20 holds about you, together with information about how that data is being processed. sat20 will provide this information in a structured, commonly used, and machine-readable format upon request.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data sat20 holds about you. Where data is held in connection with your KYC verification, corrections may require resubmission of supporting documentation.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that this right is subject to sat20's legal data retention obligations — data required for anti-money-laundering record-keeping may not be deleted until the applicable mandatory retention period has expired.
• Right to restrict processing: You have the right to request that sat20 restrict its processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested or while you have objected to processing based on legitimate interest.
• Right to data portability: Where sat20 processes your personal data by automated means on the basis of your consent or performance of a contract, you have the right to receive that data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object: You have the right to object to processing based on sat20's legitimate interest at any time. sat20 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where sat20 processes your data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time by contacting support@sat20.io or updating your communication preferences in your account dashboard after each sat20 Login. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

The sat20 Platform is strictly intended for adults aged 21 years and above. sat20 does not knowingly collect, process, or retain personal data from any individual under the age of 21. The sat20 Login process and account registration flow are designed to reject applications from persons who do not confirm they meet the minimum age requirement.

If sat20 becomes aware that personal data has been collected from a person under 21 — whether as a result of a fraudulent age declaration or any other circumstance — it will immediately suspend the relevant account, permanently delete the data collected from that individual without delay, and forfeit any balance held in that account.

Parents and guardians who have reason to believe that a minor has registered an account on sat20 should contact sat20 immediately at support@sat20.io so that appropriate action can be taken without delay.

The personal data collected from Bangladeshi players by sat20 may be processed on servers located outside Bangladesh. Where such international transfers occur, sat20 takes steps to ensure that appropriate safeguards are in place to maintain a level of data protection consistent with the principles set out in this Policy.

Safeguards employed by sat20 for international data transfers include:

• Contractual data processing agreements with all third-party processors that impose data protection obligations equivalent to those described in this Policy
• Transfer of only the minimum necessary personal data to third-party processors outside Bangladesh
• Regular review of third-party processor security and compliance standards

By using the sat20 Platform and completing the sat20 Login process, you acknowledge and consent to the transfer of your personal data to servers located outside Bangladesh where such transfers are necessary for the delivery of Platform services, subject to the safeguards described above.

sat20 may send you promotional communications — including information about bonuses, seasonal promotions (such as BPL season offers, Eid specials, and Pohela Boishakh promotions), new game launches, and platform updates — where you have provided your explicit consent to receive such communications during the registration process or at any subsequent point.

sat20 will not send you unsolicited marketing communications. Marketing emails will be sent only to the email address registered on your account and only for as long as your consent remains active.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in every marketing email sent by sat20
• Updating your communication preferences in your account dashboard following each sat20 Login
• Sending a written request to support@sat20.io with the subject line "Marketing Opt-Out"

Withdrawal of marketing consent will be processed within five (5) business days. Transactional communications — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — are not marketing communications and will continue to be sent regardless of your marketing preference setting, as they are necessary for the performance of your account contract with sat20.

sat20 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or sat20's data processing practices. Where a material change is made to this Policy, sat20 will notify you by posting a prominent notice on the Platform and, where practicable, by sending a notification to your registered email address, at least fourteen (14) days before the change takes effect.

Your continued use of the Platform — including completing a sat20 Login — after the effective date of any revised Policy constitutes your acceptance of the revised terms. If you do not agree with a revised Policy, you should immediately cease using the Platform and contact support to arrange account closure.

The "Last updated" date displayed at the top of this Policy indicates the date on which the most recent revision took effect. sat20 recommends that you review this Policy periodically to remain informed of how your personal data is being handled.

If you have any questions, concerns, or requests relating to this Privacy Policy or sat20's data processing practices, please contact the sat20 Data Protection team using the details below:

• Email: support@sat20.io (plain text — not a clickable link)
• Subject line: "Privacy Policy Enquiry — [Your Name]"
• Live support: Available 24/7 via the live chat feature accessible after every sat20 Login
• Response time: Email enquiries are acknowledged within five (5) business days and fully responded to within thirty (30) calendar days of receipt

All formal data rights requests and legal notices must be submitted in writing to support@sat20.io. sat20 will acknowledge receipt of all formal requests within two (2) business days and will respond substantively within the timeframes set out in Section 10 of this Policy.

If you are dissatisfied with sat20's response to a data rights request or a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.