bk23 Privacy Policy — How We Handle Your Personal Data

Information You Provide Directly

• Registration information: your mobile phone number, chosen username, and password (stored in hashed form).
• Identity verification (KYC) documents: government-issued identification, proof of address, and/or proof of age where required by our KYC process.
• Payment information: mobile wallet identifiers (bKash number, Nagad number, Rocket number) and bank account details where applicable, as provided for the purpose of processing deposits and withdrawals.
• Support communications: messages, emails, and records of interactions with the bk23 customer support team.

Information Generated Automatically

• Device and browser information: device type, operating system version, browser type and version, screen resolution, and device identifiers.
• Network and connection data: IP address, approximate geographic location derived from IP, network provider, and connection type.
• Gameplay and transaction logs: game sessions played, wagering activity, deposit and withdrawal history, bonus usage, and session timestamps — all stored for operational, fraud prevention, and regulatory compliance purposes.
• Cookie data: session cookies, preference cookies, and analytics cookies as described in Section 5 of this Policy.

Information From Third Parties

• Payment processor confirmations: transaction status data received from bKash, Nagad, Rocket, Upay, and banking partners to verify that deposits have been received or withdrawals have been processed.
• Identity verification service data: results of automated KYC checks conducted through third-party identity verification providers, where applicable.
• Fraud and risk screening data: information from fraud detection services used to protect the platform and its players from fraudulent activity.

Purposes for which we process your personal data:

• Account creation and management: to register your account, verify your identity, maintain your account preferences, and enable you to log in securely.
• Payment processing: to process your deposits via bKash, Nagad, Rocket, Upay, and bank transfer, and to process your withdrawal requests back to your registered payment instrument.
• Legal and regulatory compliance: to fulfill our obligations under applicable anti-money laundering regulations, fraud prevention requirements, age verification laws, and any other legal requirements applicable to the operation of an online gaming and sports betting platform.
• Customer support: to respond to your queries, resolve account issues, investigate complaints, and communicate with you regarding your account or transactions.
• Fraud detection and platform security: to identify and prevent fraudulent activity, account abuse, bonus exploitation, and any activity that may harm the platform, its players, or third-party payment providers.
• Platform improvement and analytics: to understand how players use the bk23 platform in aggregate, identify technical issues, improve game performance, and enhance the overall user experience on Android and iOS devices in Bangladesh.

Service Providers

bk23 engages third-party service providers to assist in the operation of the platform. These include payment processing partners (bKash, Nagad, Rocket, Upay, and banking partners), game technology providers (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe, and others), KYC and identity verification providers, fraud detection services, and cloud infrastructure providers. All service providers are contractually bound to process personal data only on bk23's instructions and to maintain appropriate technical and organisational security measures.

Legal and Regulatory Disclosure

bk23 may disclose personal data to regulatory authorities, law enforcement agencies, financial intelligence units, or courts where required to do so by applicable law, court order, or regulatory direction. bk23 will notify affected players of such disclosures where it is legally permitted to do so.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of bk23's assets, personal data held by bk23 may be transferred to the acquiring entity as part of that transaction. Affected players will be notified of any such transfer and any resulting change in the Privacy Policy that governs their data.

Types of cookies used on bk23:

• Essential cookies: required for the platform to function. These include session authentication cookies that keep you logged in during your visit, and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Preference cookies: store your account settings and display preferences, such as chosen language and notification settings, so they are remembered between sessions.
• Analytics cookies: collect anonymised, aggregated data about pages visited, session duration, and navigation paths to help bk23 understand platform usage patterns and improve the user experience. No personally identifiable information is included in analytics data.

Active Account Data

Personal data associated with an active player account is retained for the duration of the account's active status. This includes registration information, KYC documents, payment method records, gameplay logs, and transaction history. This data is necessary to operate the account, process transactions, comply with ongoing AML obligations, and resolve any disputes that may arise during the active period.

Closed Account Data

Following account closure, bk23 retains certain personal data for a minimum period as required by applicable financial crime prevention regulations. KYC documents and transaction records are typically retained for a period of five years from account closure, unless a longer retention period is required by law or by an ongoing regulatory investigation. After the applicable retention period expires, personal data is securely deleted or anonymised. Players who request early deletion of their data should be aware that bk23 may be unable to fulfil such requests where retention is required by law.

Your rights include:

• Right of access: you may request a copy of the personal data bk23 holds about you, along with information about how it is being used.
• Right of rectification: if you believe that personal data bk23 holds about you is inaccurate or incomplete, you may request that it be corrected.
• Right of erasure: in certain circumstances you may request that bk23 delete personal data it holds about you. This right is subject to legal retention obligations — bk23 may be unable to delete data that it is required by law to retain.
• Right to restrict processing: you may request that bk23 restrict the processing of your personal data in certain circumstances, for example while a rectification request is being reviewed.
• Right to object: where bk23 processes your personal data on the basis of legitimate interests, you have the right to object to that processing. bk23 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

Technical Measures

All data transmitted between your device and bk23 servers is encrypted in transit using SSL/TLS protocols. Passwords are stored using one-way cryptographic hashing and are never stored or transmitted in plain text. Access to production systems containing personal data is restricted to authorised personnel only, protected by multi-factor authentication, and subject to access logging and regular review. Payment card data is never stored by bk23; all payment processing is handled by PCI-DSS compliant payment processors.

Reporting a Security Issue

If you discover or suspect a security vulnerability on the bk23 platform, or if you believe your account has been accessed without authorisation, please contact [email protected] immediately. bk23 takes all security reports seriously and will investigate promptly. Do not attempt to exploit any vulnerability you discover — responsible disclosure helps protect all players on the platform.