Privacy Policy — bkko

1 Introduction

bkko ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy describes how bkko collects, uses, stores, discloses, and otherwise processes personal data about individuals ("you", "your", "the Player") who access or use the bkko platform available at bkko.io, including all associated games, sports betting markets, payment services, and customer support functions.

This policy is written to be clear, specific, and easy to understand. We do not use deliberately vague language to obscure how your data is handled. Where we use legal or technical terms, we define them in plain English at first use. Our goal is to ensure that every bkko player in Dhaka, Chittagong, Sylhet, Khulna, or anywhere else across Bangladesh can make a fully informed decision about sharing their personal information with us.

This Privacy Policy should be read alongside the bkko Terms & Conditions, which govern your use of the platform as a whole. If there is any conflict between this Privacy Policy and the Terms & Conditions on a privacy-related matter, this Privacy Policy shall take precedence.

If you have any questions about this policy, or wish to exercise any of your privacy rights, please contact us at [email protected] at any time. Our English-language support team is available 24 hours a day, 7 days a week.

2 Personal Data We Collect

bkko collects the following categories of personal data, depending on how you interact with the platform. We collect only the minimum data necessary for each stated purpose and do not retain data beyond the period required for that purpose.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation, unless such data is incidentally included in documents submitted for KYC verification purposes, in which case it is processed solely for verification and not for any other purpose.

3 How We Collect Your Data

bkko collects personal data through the following channels and mechanisms:

• Direct interactions: Data you provide when creating your bkko account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to surveys or promotional communications.
• Automated technologies: As you use the bkko platform, we automatically collect Technical Data and Usage Data via server logs, session cookies, local storage, and performance monitoring tools embedded within the platform.
• Payment service providers: When you process a payment via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, or BRAC Bank, the relevant provider shares transaction confirmation data with bkko to enable crediting of your Account Balance.
• Identity verification providers: During the KYC process, bkko may use a third-party verification service to cross-check the identity documents you submit against authoritative databases. The verification service returns only a pass/fail result and a risk score; they do not store a permanent copy of your documents on behalf of bkko.
• Game studios: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may log technical session data (session token, stake, outcome) for game integrity purposes. This data is shared back to bkko in aggregated form for transaction reconciliation.
• Fraud prevention services: bkko uses automated fraud scoring tools that analyse device fingerprints, IP reputation data, and behavioural patterns to detect account fraud, bonus abuse, and money-laundering activity. These tools process Technical Data and Transaction Data in real time.

4 Purposes of Processing

bkko processes your personal data only for specific, explicit, and legitimate purposes. We do not use your data for any purpose that is incompatible with the purposes listed below. The primary purposes for which we process personal data are:

1. Account creation and management: To register your Player Account, verify your identity and age (21+ requirement), maintain your Account Balance, and provide access to the full range of platform services.
2. Payment processing: To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank, and to maintain an accurate record of all financial transactions on your Account.
3. Regulatory compliance: To meet anti-money laundering (AML) obligations, counter-terrorist financing (CTF) screening requirements, and any other applicable legal obligations, including cooperation with law enforcement or regulatory authorities when lawfully required.
4. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, multi-accounting, and any other activity that harms the integrity of the platform or other players.
5. Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide you with technical assistance related to your Account or any transaction.
6. Responsible gaming: To monitor gameplay patterns for indicators of problem gambling, to administer self-exclusion and deposit limit requests, and to ensure that bkko meets its duty-of-care obligations to all players.
7. Platform improvement: To analyse aggregate usage patterns, identify technical errors, optimise game loading performance, and improve the overall player experience based on anonymised behavioural data.
8. Direct marketing (with consent): To send you promotional emails, bonus offers, tournament announcements, and news about new games or features, where you have explicitly opted in to receive such communications.

bkko does not engage in automated decision-making that produces legal or similarly significant effects solely based on profiling, without human review.

5 Legal Basis for Processing

Every instance of personal data processing by bkko is grounded in one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between bkko and the Player — including account registration, payment processing, bet settlement, and customer support — is carried out on the basis that it is necessary to deliver the services you have requested.
• Legal obligation: Processing required to comply with applicable laws — including AML/CTF regulations, age verification requirements, and cooperation with law enforcement — is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, platform security, abuse detection, and aggregate analytics is based on bkko's legitimate interest in maintaining a secure, fair, and commercially viable gaming environment. bkko has assessed that these legitimate interests are not overridden by your individual rights in the context of a regulated gambling platform.
• Consent: Processing for direct marketing communications is carried out solely on the basis of your explicit, informed, freely given consent. You may withdraw this consent at any time without penalty by emailing [email protected].

6 Data Sharing & Disclosure

bkko will never sell, rent, or trade your personal data to any third party for their own independent commercial purposes. Data sharing is strictly limited to the following categories of recipients, each of whom is bound by appropriate data processing agreements or legal obligations:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank receive the minimum transaction data necessary to authorise and settle your deposits and withdrawals. Each provider operates under its own privacy policy and financial services regulations.
• KYC and identity verification providers: Third-party verification services receive a copy of your identity documents and return a verification result. These providers are contractually prohibited from retaining or using your data for any purpose beyond the verification service.
• Game studio partners: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe, and other certified game providers receive a session token and stake data when you launch a game. They do not receive your full name, payment details, or contact information.
• Fraud prevention and security vendors: Automated risk-scoring and device-fingerprinting services receive Technical Data for fraud analysis. Data shared with these providers is pseudonymised wherever technically feasible.
• Legal and regulatory authorities: bkko will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, a valid court order, or a legally binding regulatory direction. bkko will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of bkko's business assets, your personal data may be transferred to the acquiring entity. We will notify you by email and/or a prominent notice on the platform before your data becomes subject to a different privacy policy as a result of such a transaction.

7 Cookies & Tracking Technologies

bkko uses cookies and similar local storage technologies on the platform. A cookie is a small text file placed on your device that enables the platform to recognise your browser across sessions. The following types of cookies are used on bkko.io:

bkko does not use behavioural advertising cookies, cross-site tracking pixels, or social media retargeting tags on any page of the platform. Strictly necessary cookies do not require your consent as they are essential to the operation of the service. All other cookie types are deployed only where you have provided consent through your browser settings or our cookie preference tool.

You may disable non-essential cookies by adjusting your browser settings at any time. Please note that disabling functional cookies may affect the quality of your experience on certain pages of the platform.

8 Data Retention

bkko retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five years following permanent account closure, to meet AML and regulatory record-keeping obligations.
• Transaction and financial data: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping requirements.
• Responsible gaming data: Self-exclusion records and problem gambling flags are retained indefinitely after account closure to prevent re-registration by a self-excluded player. This retention is necessary to protect the player's own safety.
• Customer support communications: Retained for three years from the date of the last communication in a support thread.
• Marketing consent records: Retained for two years from the date of consent, or until consent is withdrawn, whichever is earlier.
• Technical and usage data: Server logs are retained for 90 days. Aggregated, anonymised analytics data may be retained indefinitely as it does not constitute personal data once anonymised.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with bkko's internal data disposal procedures. You may request early deletion of certain categories of data, subject to the right-to-erasure conditions described in Section 10.

9 Data Security

bkko implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Our key security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the bkko servers is encrypted in transit using industry-standard TLS 1.3 protocols. The bkko.io domain enforces HTTPS on all pages without exception.
• Password hashing: Player passwords are stored using a one-way adaptive hashing algorithm (bcrypt). Plaintext passwords are never stored or accessible to any bkko employee at any time.
• Access controls: Access to systems containing personal data is restricted on a strict need-to-know basis. Staff access is governed by role-based permission controls, and all access events are logged for audit purposes.
• Infrastructure security: bkko servers are hosted in secure data centres with physical access controls, redundant power supplies, and 24/7 monitoring. Regular penetration testing and vulnerability assessments are conducted by independent security specialists.
• Incident response: bkko maintains a documented data breach response plan. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you without undue delay and in accordance with applicable legal timescales.

10 Your Privacy Rights

As a bkko player, you hold the following rights in relation to your personal data. To exercise any of these rights, please email [email protected] with the subject line "Privacy Rights Request" and specify which right(s) you wish to exercise. bkko will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

• Right of Access: You may request a copy of all personal data that bkko holds about you, along with information about how it is being processed. Responses are provided free of charge for one request per 12-month period.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete. Where the correction relates to your registered name or date of birth, supporting documentation will be required.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other legal basis), or where the data has been unlawfully processed. This right does not apply where retention is required by law (e.g., AML record-keeping obligations).
• Right to Restriction: You may request that bkko temporarily stop processing your personal data — for example, while the accuracy of the data is being contested — rather than requesting full deletion.
• Right to Data Portability: Where processing is based on your consent or on a contractual necessity, you may request a structured, machine-readable copy of your personal data (in CSV or JSON format) to transfer to another service provider.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes, with immediate effect. You may also object to processing carried out on the basis of legitimate interests; bkko will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

11 Children's Privacy

bkko implements age verification controls at the point of registration and during the KYC process to prevent underage access to the platform. If bkko becomes aware that a Player Account has been created by or on behalf of a person under the age of 21, the following actions will be taken immediately:

1. The Account will be suspended pending investigation.
2. All personal data associated with the Account will be reviewed.
3. No winnings will be paid out from the Account.
4. Any deposits made will be returned to the depositing payment method after completion of the investigation.
5. All personal data belonging to the underage individual will be securely deleted as promptly as legally permissible.

If you believe that a person under 21 years of age has accessed or is accessing the bkko platform, please report this immediately to [email protected]. We take all such reports seriously and will investigate without delay.

12 Third-Party Links

The bkko platform may, on occasion, display informational references to third-party organisations such as payment partners (bKash, Nagad), game providers (Pragmatic Play, Evolution Gaming), or sports bodies (ICC, BPL). Where such references include links to external websites, please note that bkko has no control over the privacy practices or content of those external sites.

This Privacy Policy applies exclusively to the bkko platform at bkko.io and does not extend to any third-party website, even if it is accessible via a link displayed on the bkko platform. We strongly encourage you to read the privacy policy of any third-party site you visit before providing any personal information to that site.

bkko is not responsible for the privacy practices, security standards, or data handling procedures of any third-party website or service provider that operates independently of the bkko platform.

13 Updates to This Privacy Policy

bkko reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. The most current version of this policy will always be accessible at bkko.io/privacy-policy and will display the "Last Updated" date at the top of the document.

Where a proposed update is material — meaning it significantly changes how your personal data is collected, used, or shared — bkko will provide at least 14 days' advance notice of the change by sending an email to your registered email address and/or displaying a prominent notice within your Account area on the platform.

For minor, non-material updates (such as clarifications of existing language, correction of typographical errors, or updates to contact details), bkko may update the policy without prior notice, relying on the "Last Updated" date as the indicator of the revision.

Your continued use of the bkko platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree with any material change to this policy, you may close your Account and request withdrawal of your Real-Money Balance in accordance with the Terms & Conditions.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which bkko processes your personal data, please contact us using the details below. All privacy-related enquiries are handled by our dedicated support team and treated with strict confidentiality.

• Email: [email protected] — for all privacy rights requests, data access queries, and general privacy enquiries.
• Subject Line: Please use "Privacy Rights Request" for data subject requests, or "Privacy Enquiry" for general questions, to ensure your message is routed to the correct team.
• Response Time: We acknowledge all privacy-related emails within 5 business days and provide a substantive response within 30 calendar days of receipt.
• Support Hours: 24 hours a day, 7 days a week, 365 days a year. Bangladesh Standard Time (BST, UTC+6).

bkko serves players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. All privacy communications are conducted in English. We are committed to handling every privacy request fairly, transparently, and within the timeframes set out in this policy.