bdtk Privacy Policy — How We Handle Your Personal Data

1. Who We Are

bdtk is an online betting and casino platform accessible at bdtk.im, offering sports betting, live casino games, slots, crash games, and related gaming products to eligible players based in Bangladesh. Throughout this Privacy Policy, references to "bdtk", "we", "us", or "our" refer to the bdtk platform and its operating entity. References to "you" or "the player" refer to any individual who visits, registers on, or uses the bdtk platform in any capacity.

As the entity responsible for determining how and why your personal data is processed, bdtk acts as the data controller for all personal information collected through the platform. Any questions, requests, or complaints regarding your personal data should be directed to our support team at [email protected].

2. Data We Collect

bdtk collects personal data from you in the following categories, depending on how you interact with the platform:

2.1 Registration & Identity Data

When you create a bdtk account, we collect your full legal name, date of birth, residential address, email address, and mobile phone number. This data is required to open and maintain your account and to comply with our age verification and Know Your Customer (KYC) obligations.

2.2 Identity Verification (KYC) Documents

To process withdrawals and meet Anti-Money Laundering (AML) requirements, we collect copies of identity documents including your National Identity Card, passport, or driving licence, together with proof of address documents such as utility bills or bank statements. These documents are processed by our KYC verification partner and stored securely for the duration required by applicable regulations.

2.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, and bets placed on your account, including the amounts, timestamps, payment methods used (such as bKash, Nagad, Rocket, Upay, Visa, or Mastercard), and transaction reference numbers. We do not store full payment card numbers or mobile wallet PINs — these are handled directly by your payment provider.

2.4 Device & Technical Data

When you access the bdtk platform, we automatically collect certain technical data including your IP address, browser type and version, operating system, device type (mobile, tablet, or desktop), screen resolution, and referring URL. This data is used for fraud prevention, platform security, and aggregate analytics purposes.

2.5 Usage & Behavioural Data

We collect data about how you interact with the platform, including the games you play, the sports markets you view, your betting history, session duration, and navigation patterns within the site. This data is used to personalise your experience, improve our products, and detect unusual account activity that may indicate fraud or problem gambling patterns.

2.6 Communications Data

If you contact our support team via live chat, email, or any other channel, we retain a record of that communication including its content, timestamp, and resolution outcome. This data is used for quality assurance, training, and complaint resolution purposes.

2.7 Marketing Preferences

Where you have opted in to receive marketing communications, we hold a record of your marketing consent, the date it was given, and your preferred communication channels. We also record any opt-out instructions you provide so that we can honour them immediately.

3. How We Use Your Data

The personal data we collect is used for the following specific purposes:

Purpose	Data Used
Opening and managing your player account	Registration data, identity data
Age verification and KYC compliance	Date of birth, identity documents, proof of address
Processing deposits and withdrawals	Financial data, payment method data
Fraud prevention and AML monitoring	Device data, transaction data, usage data
Customer support and complaint resolution	Communications data, account data
Platform security and technical operations	Device data, IP address, usage data
Responsible gaming monitoring	Behavioural data, betting history, session data
Personalising your platform experience	Usage data, game preferences
Sending promotional offers (where consented)	Email address, phone number, marketing preferences
Legal and regulatory compliance	Identity data, financial data, KYC documents

We do not use your personal data for any purpose not listed above without first obtaining your explicit consent or providing you with advance notice.

4. Legal Basis for Processing

bdtk processes your personal data on the following legal bases:

• Contractual necessity: Processing required to open your account, manage your balance, process transactions, and deliver the services described in our Terms & Conditions.
• Legal obligation: Processing required to comply with AML regulations, age verification requirements, KYC obligations, and any lawful requests from competent authorities.
• Legitimate interests: Processing carried out to prevent fraud, ensure platform security, improve our products, and monitor for responsible gaming concerns — provided such interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and personalised promotions, where you have provided explicit, freely given, and revocable consent.

Where we rely on consent as our legal basis, you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal. Withdrawal of marketing consent does not affect your ability to use the platform.

5. Data Sharing & Third Parties

5.1 KYC Verification Partners

To fulfil our identity verification obligations, we share relevant identity document data with our contracted KYC verification partner. This partner is bound by strict data processing agreements and is prohibited from using your data for any purpose other than verifying your identity on our behalf.

5.2 Payment Processors

To process your deposits and withdrawals, we share the minimum necessary transaction data with your chosen payment provider — which may include bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, or Mastercard. bdtk does not store full card numbers or mobile wallet authentication credentials; these remain solely within your payment provider's systems.

5.3 Game Software Providers

Live casino games, slots, and crash games on the bdtk platform are supplied by third-party providers including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. To enable gameplay, your account identifier and bet data are transmitted to the relevant provider's game server in real time. These providers operate under certified fair gaming and data security standards.

5.4 Fraud Prevention & Security Services

bdtk may share device fingerprint data, IP addresses, and behavioural signals with fraud detection services for the purpose of identifying and preventing fraudulent account activity, bonus abuse, and money laundering.

5.5 Legal & Regulatory Disclosures

bdtk may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required by a valid legal obligation, court order, or regulatory direction. We will notify you of any such disclosure where we are legally permitted to do so.

5.6 What We Never Do

bdtk does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. We do not share your data with data brokers, advertising networks, or social media platforms for targeted advertising purposes.

6. Data Retention

bdtk retains your personal data for as long as your account is active and for a defined period thereafter, consistent with our legal and regulatory obligations:

• Active account data (registration details, transaction records, KYC documents): retained for the full duration of your account's active life.
• Post-closure account data: retained for a minimum of five years following account closure, in accordance with standard AML record-keeping obligations applicable to financial services platforms operating in or serving Bangladesh.
• Communications data (support tickets, chat transcripts): retained for three years from the date of the interaction.
• Marketing data (consent records, opt-out records): retained for three years from the last interaction, or until you request deletion, whichever is sooner.
• Technical and device logs: retained for up to 12 months for fraud detection and security audit purposes, then purged automatically.

Once the applicable retention period expires, your personal data is either permanently deleted or irreversibly anonymised so that it can no longer be linked to you as an individual.

7. Your Data Rights

You hold the following rights with respect to your personal data held by bdtk. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered account email address. We will respond within 30 calendar days.

• Right of Access: You may request a copy of all personal data we hold about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where we have no overriding legitimate interest or legal obligation to retain it. Note that AML and KYC record-keeping obligations may prevent immediate erasure of certain data categories.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved.
• Right to Data Portability: You may request that we provide your personal data in a structured, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as our legal basis, including profiling for responsible gaming monitoring. We will honour your objection unless we can demonstrate compelling legitimate grounds for the processing.
• Right to Withdraw Marketing Consent: You may withdraw consent to receive marketing communications at any time by contacting support or updating your account preferences. Withdrawal takes effect within 48 hours.

8. Cookies & Tracking

8.1 What Cookies We Use

bdtk uses the following categories of cookies on the platform:

• Essential cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in during your visit, and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: Used to remember your preferences such as language settings and preferred game categories, so you do not have to reconfigure them each visit.
• Analytics cookies: Used to collect anonymised, aggregate data about how players navigate and use the platform. This data helps us identify usability issues and improve the platform experience. Analytics data is never linked to individual player identities.

8.2 What We Do Not Use

bdtk does not use third-party advertising cookies, social media tracking pixels, behavioural retargeting technologies, or any cookies that track your activity across other websites and apps outside of the bdtk platform.

8.3 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies via their privacy or settings menus. Please note that disabling essential cookies will prevent you from logging in and using the platform. Disabling analytics cookies will not affect your ability to use any platform feature.

9. Children & Minors

The bdtk platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. All registration attempts include mandatory date-of-birth verification, and accounts that fail to meet the age threshold are rejected at the point of registration.

If bdtk becomes aware that personal data has been collected from a person under the age of 21 — for example, through a false date of birth being provided at registration — we will immediately suspend the account, delete all associated personal data to the extent permitted by AML obligations, and refund any deposit funds following a source-of-funds review. If you have reason to believe that a minor has registered on the bdtk platform, please notify us immediately at [email protected].

10. Data Security

bdtk implements a layered technical and organisational security framework to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption at rest: All personal data stored in bdtk's databases is encrypted using AES-256 encryption.
• Encryption in transit: All data transmitted between your device and our servers is protected by TLS 1.3 (Transport Layer Security), ensuring that your login credentials, payment data, and personal information cannot be intercepted in transit.
• Access controls: Access to personal data within bdtk's systems is restricted on a strict need-to-know basis. Staff with access to player data are subject to confidentiality obligations and regular security training.
• Vulnerability management: bdtk conducts regular security assessments, penetration tests, and code audits to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data breach that affects your personal data, bdtk will notify you by email to your registered address within 72 hours of becoming aware of the breach, providing details of what data was affected and the steps being taken to contain and remediate the incident.

While we make every effort to protect your data, no digital platform can guarantee absolute security. You also play an important role in keeping your account secure — please use a strong, unique password for your bdtk account and never share your login credentials with anyone.

11. International Data Transfers

bdtk primarily serves players based in Bangladesh and stores personal data on servers located within secure data centres. Where personal data is transferred to or processed by third-party service providers located outside Bangladesh — for example, game software providers or cloud infrastructure partners — bdtk ensures that such transfers are governed by appropriate contractual safeguards, including data processing agreements that require the recipient to apply data protection standards equivalent to those applied by bdtk.

bdtk will not transfer your personal data to a country or territory that does not offer an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your explicit consent.

12. Changes to This Policy

bdtk reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or platform features. When material changes are made, we will notify registered players by email to the address on file, with a minimum of 14 days' notice before the revised policy takes effect.

The current version of this Privacy Policy is always accessible at bdtk.im/privacy-policy and carries the effective date noted in the document header. The current version is effective from January 2026 (v2026.01). We encourage you to review this page periodically to stay informed of any updates. Your continued use of the platform following the effective date of any revision constitutes acceptance of the updated policy.

13. Contact & Data Requests

For all privacy-related enquiries, data access requests, deletion requests, or complaints, please contact us using the details below. All email addresses are displayed as plain text and are not clickable links.

• Privacy Enquiries Email: [email protected]
• Subject Line for Data Requests: "Data Rights Request — [Your Registered Email]"
• Response Time: Within 30 calendar days of receipt
• Support Hours: 24 hours a day, 7 days a week (Live Chat); 4–12 hours for email responses (Bangladesh Standard Time, UTC+6)

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate your complaint to a relevant data protection authority. We will provide further guidance on available escalation routes upon request.

This Privacy Policy was last reviewed and updated in January 2026. Effective version: v2026.01.