bdoak Privacy Policy — Your Data, Your Rights

bdoak ("the Platform", "we", "us") is committed to protecting the privacy and personal data of all players and visitors who use the bdoak website and services. This Privacy Policy has been prepared to explain our data handling practices in clear, plain language so that you can make informed decisions about the personal information you share with us.

This policy applies to all personal data collected through the bdoak platform, including data provided during registration, during KYC verification, during financial transactions, during gameplay, and through any communications you initiate with the bdoak support team. By creating an account or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle your data, please do not use the platform.

bdoak uses the personal data we collect for the following purposes, each of which is necessary for the operation of the platform or for compliance with applicable requirements:

• Account creation and authentication: to create your account, verify your identity at login, and maintain the security of your session.
• KYC and identity verification: to verify that you meet the minimum age requirement of 21 years, confirm that you are the owner of the payment method used, and comply with anti-money laundering obligations.
• Payment processing: to process your BDT deposits and withdrawals via bKash, Nagad, Rocket, and other supported channels, and to maintain accurate transaction records.
• Platform operations and game settlement: to operate the game lobby, settle bets, apply bonuses, and ensure the correct functioning of all platform features.
• Security and fraud prevention: to detect and prevent unauthorised account access, fraudulent transactions, multi-accounting, bonus abuse, and other prohibited activities listed in our Terms & Conditions.
• Customer support: to respond to your enquiries, investigate and resolve disputes, and maintain a service history that enables consistent support across interactions.

bdoak does not use your personal data for unsolicited direct marketing or sell it to third-party marketing companies. Any platform communications regarding promotions or account activity will be limited to the mobile number you registered with, and only where you have not opted out of such communications.

bdoak processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing required to fulfil our agreement with you — including operating your account, processing transactions, and settling bets.
• Legal obligation: processing required to comply with applicable law, including age verification, KYC, anti-money laundering controls, and record-keeping obligations.
• Legitimate interests: processing carried out in bdoak's legitimate interests, including fraud detection, security monitoring, platform optimisation, and responsible gaming enforcement — where those interests are not overridden by your rights.
• Consent: where we send optional promotional communications, we do so on the basis of your consent, which you may withdraw at any time by contacting support.

bdoak does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Game providers (such as Pragmatic Play, Evolution Gaming, Spribe): game session data is passed to third-party providers to operate their games on our platform. These providers are contractually bound to data confidentiality and may not use player data for their own marketing purposes.
• Payment processors (bKash, Nagad, Rocket, and bank partners): transaction identifiers and amounts are shared with payment partners to process deposits and withdrawals. These parties operate under their own regulatory obligations and privacy frameworks.
• Fraud prevention and compliance partners: anonymised or pseudonymised data may be shared with specialist providers that help us detect fraud, verify identity, and monitor for unusual transaction patterns.
• Regulatory authorities and law enforcement: where bdoak is required by law, court order, or lawful regulatory direction to disclose personal data, we will do so. We will, where legally permitted, notify the affected player before such disclosure.

In all cases where we share data with third parties, we apply contractual controls to ensure that the receiving party handles that data responsibly and in accordance with applicable privacy obligations. bdoak does not authorise any third party to use your personal data for purposes other than those for which it was shared.

KYC documents submitted to bdoak — including National ID cards, passports, and any supporting proof of address — are handled with elevated security controls. These documents are stored in an encrypted format and access is restricted to a small number of authorised personnel whose role requires them to review identity documentation as part of the verification process. KYC documents are not shared with game providers or marketing partners under any circumstances.

Payment data handled by bdoak is limited to transaction identifiers, amounts, timestamps, and the account identifiers of the payment channels used (such as a bKash wallet number). bdoak does not store full bank account numbers, card numbers, or mobile banking PINs. All payment data in transit is protected by SSL encryption. Payment channel credentials (mobile wallet PINs, internet banking passwords) are never requested by bdoak through any channel.

bdoak retains personal data only for as long as is necessary for the purpose for which it was collected, or for as long as we are required to retain it under applicable law. The following general retention periods apply: active account data is retained for the duration of your account relationship with bdoak; transaction and KYC records are retained for a minimum of five years following the last transaction or account closure, in line with anti-money laundering record-keeping requirements; support communication records are retained for two years; device and session logs are retained for ninety days for security and fraud investigation purposes.

When personal data is no longer required and no legal retention obligation applies, bdoak will securely delete or anonymise that data. If you request account closure, bdoak will process the deletion of your personal data to the extent permitted by law and after satisfying any outstanding retention obligations. Specific data categories that are subject to legal retention obligations (such as AML records) cannot be deleted on request prior to the expiry of the relevant retention period.

bdoak will respond to data rights requests within 30 days of receipt. Where a request is complex or we receive a high volume of requests simultaneously, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. bdoak will not charge a fee for processing a data rights request unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee.

bdoak uses cookies and similar tracking technologies to operate the platform, maintain your session state, support security monitoring, and understand aggregate usage patterns. Cookies are small data files placed on your device by your browser when you visit the bdoak platform. The following types of cookies are used: strictly necessary cookies (required for the platform to function — these cannot be disabled); session cookies (temporary cookies that expire when you close your browser); and persistent cookies (retained across sessions to remember your preferences and login state).

bdoak does not place third-party advertising or behavioural tracking cookies on your device. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may prevent the platform from functioning correctly. For details on which cookies are currently active on the platform, contact the bdoak support team.

bdoak takes the security of your personal data seriously. The platform employs industry-standard security measures including SSL/TLS encryption for all data in transit between your device and our servers, encrypted storage for sensitive data at rest (including KYC documents and password hashes), access controls that limit internal access to personal data on a need-to-know basis, and regular security reviews of platform infrastructure and third-party integrations.

While bdoak applies robust security controls, no internet-based platform can guarantee absolute security against all possible threats. In the event of a data security incident that materially affects your personal data, bdoak will notify you without undue delay and will take prompt action to contain and investigate the incident. You can help protect your own account by keeping your login credentials confidential and reporting any suspected unauthorised access immediately.

bdoak does not knowingly collect personal data from individuals under the age of 21. The platform is not directed at, and is not intended for use by, anyone under the age of 21. Age verification is a mandatory step in the registration and KYC process and bdoak takes reasonable technical and procedural measures to prevent underage persons from accessing the platform.

bdoak reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, the updated policy will be published on this page with a revised effective date. Where the changes are significant and affect how we process your personal data in a way that may impact your rights, bdoak will provide notice via the mobile number or contact channel registered to your account.

Your continued use of the bdoak platform after a revised Privacy Policy has been published on this page constitutes your acknowledgement of the updated policy. If you do not agree with the revised policy, you should stop using the platform and may request account closure by contacting the support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data bdoak holds about you, please contact the bdoak data team via the email address displayed in the footer of this website. When submitting a data rights request, please include your registered mobile number and a brief description of the right you wish to exercise so that we can locate your account and process your request efficiently. bdoak handles all data-related queries in Bangladesh Standard Time (BST, UTC+6) and aims to respond within 30 days.