Privacy Policy — bk33cm

1 Introduction

This Privacy Policy ("Policy") describes how bk33cm ("we", "us", "our") collects, processes, stores, and protects the personal information of individuals ("you", "your", "player") who access or use the bk33cm online casino and sports betting platform available at https://bk33cm.app ("Platform").

bk33cm is committed to handling your personal data with the highest standards of care, transparency, and security. This Policy is intended to give you a clear and honest account of our data practices so that you can make informed decisions about your engagement with the Platform. We encourage you to read this Policy carefully before registering an account or submitting any personal information to us.

By creating a bk33cm account or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood its contents and consent to the data practices described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and may contact us to request account closure.

2 Data Controller

bk33cm operates as an offshore online gaming platform. The entity responsible for the processing of your personal data in connection with the Platform is bk33cm (the "Data Controller"). All data-related queries, access requests, and complaints should be directed to our support team using the contact details set out in Section 16 of this Policy.

bk33cm does not represent that its services are regulated by any Bangladeshi governmental or data-protection authority. Players based in Bangladesh access the Platform on their own initiative and acknowledge that the Platform is operated from an offshore jurisdiction. Nonetheless, bk33cm voluntarily applies data-protection principles consistent with internationally recognised standards as a matter of good practice and player trust.

3 Data We Collect

The categories of personal data we collect about you depend on how you interact with the Platform. The following table summarises the main categories:

We do not intentionally collect special categories of sensitive personal data (such as health data, religious beliefs, or political opinions) unless you voluntarily disclose such information in a support communication or responsible gaming self-assessment. Any such data will be used solely for the purpose for which it was provided and will not be processed for any other purpose.

4 How We Collect Data

bk33cm collects personal data through the following means:

Data you provide directly when you register an account, complete the KYC process, make a deposit or withdrawal, participate in a promotion, respond to a survey, or contact our support team. This is the primary source of Identity Data, Contact Data, Financial Data, and Verification Documents.

Data collected automatically as you browse and use the Platform, including IP address, device fingerprint, browser characteristics, and in-session behavioural patterns. This data is captured via our web analytics infrastructure and via first-party cookies and local storage as described in Section 10.

In limited circumstances, bk33cm may receive data about you from third-party sources, including:

• Identity verification providers who confirm the authenticity of documents you submit during KYC.
• Payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard networks) who relay transaction metadata necessary to reconcile deposits and withdrawals.
• Fraud detection and anti-money laundering screening services that cross-reference your details against known risk databases.
• Game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) who may return session identifiers and game-round data to our back office for settlement and dispute resolution.

5 Purpose & Legal Basis

bk33cm processes your personal data for the following purposes. Where a formal legal basis framework applies, the applicable basis is noted alongside each purpose:

• Account creation and authentication — necessary for the performance of the contract between you and bk33cm (account agreement).
• Processing deposits and withdrawals — necessary for the performance of the contract; also required to comply with anti-money laundering obligations.
• Identity verification (KYC) — compliance with legal obligations and fraud prevention legitimate interests.
• Delivering and improving Platform features — legitimate interest in providing a functional, competitive, and secure gaming environment.
• Responsible gaming monitoring — legitimate interest and, where applicable, compliance with platform policy obligations to protect vulnerable players.
• Customer support and dispute resolution — performance of contract; legitimate interest in maintaining accurate records of interactions.
• Fraud prevention, AML screening, and security monitoring — compliance with legal obligations; legitimate interest in protecting the Platform and other players.
• Marketing and promotional communications — based on your consent, which you may withdraw at any time (see Section 14).
• Analytics and product development — legitimate interest in understanding how players use the Platform in order to improve it.
• Compliance with legal and regulatory requests — legal obligation where we are required by a competent authority to disclose data.

bk33cm will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your separate consent or establishing an alternative lawful basis.

6 Data Sharing

bk33cm does not sell, rent, or trade your personal data to third parties for their own commercial use. We share your data only with the following categories of recipients and only to the extent necessary for the purposes described in Section 5:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and card network processors receive transaction data necessary to execute deposits and withdrawals. These providers operate under their own privacy policies and data-handling standards.
• Identity Verification Providers: KYC and document-verification partners receive copies of your identity documents for the sole purpose of confirming their authenticity and your eligibility to hold an account.
• Game Providers: Certified third-party game studios receive a pseudonymous player identifier and session token to facilitate game-round settlement and dispute resolution. They do not receive your full name or payment details.
• Fraud Prevention and AML Services: Automated screening tools may receive your name, date of birth, and country of residence to cross-check against risk databases. Results are returned to bk33cm and are not retained by the screening provider beyond the legally permitted period.
• IT Infrastructure Providers: Cloud hosting, database management, content delivery, and cybersecurity vendors who process data on our behalf under binding data-processing agreements that prohibit them from using your data for any independent purpose.
• Legal and Regulatory Authorities: Law enforcement agencies, courts, or regulatory bodies where disclosure is required by applicable law, court order, or where we believe disclosure is necessary to protect the rights, property, or safety of bk33cm, its players, or the public.
• Professional Advisors: Lawyers, accountants, and auditors who are bound by professional confidentiality obligations and who access data only to the extent necessary to provide their services to bk33cm.

7 International Transfers

As an offshore platform, bk33cm's servers and operational infrastructure may be located in jurisdictions outside Bangladesh. When your personal data is transferred to, processed in, or stored in a country other than your country of residence, bk33cm takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy.

Such safeguards may include contractual data-processing agreements with our infrastructure and service providers that incorporate recognised data-transfer mechanisms. By using the Platform, you acknowledge and consent to the transfer of your personal data to our servers and to the servers of our trusted service providers in accordance with this Policy.

8 Data Retention

bk33cm retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

When data is no longer required, it is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised aggregated data may be retained indefinitely for statistical and product-improvement purposes.

9 Security Measures

bk33cm employs a multi-layered technical and organisational security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Transport Encryption: All data transmitted between your device and bk33cm's servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption. Our SSL certificate is maintained and renewed continuously.
• Password Hashing: User passwords are never stored in plain text. They are processed using a one-way cryptographic hashing algorithm with a unique per-user salt, meaning that even in the event of a data breach, raw passwords cannot be recovered.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA via their registered Bangladeshi mobile number. This adds a second layer of access control beyond the username and password combination.
• Role-Based Access Controls: Internal access to personal data is restricted to employees and contractors who have a documented need to access that data in the performance of their duties. Access is logged and audited.
• Intrusion Detection and DDoS Protection: Our infrastructure is monitored continuously by automated intrusion-detection systems. Distributed denial-of-service mitigation is provided by our hosting and CDN partners.
• Data Minimisation: We collect only the personal data that is strictly necessary for the purposes described in this Policy. We regularly review our data-collection practices to eliminate unnecessary data points.
• Breach Response: In the event of a data breach that poses a risk to players, bk33cm will notify affected individuals within a reasonable timeframe and take immediate steps to contain and remediate the breach.

While bk33cm takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us promptly if you suspect any unauthorised access to your account.

10 Cookies & Tracking Technologies

bk33cm uses first-party cookies and similar client-side storage technologies to operate, secure, and improve the Platform. We do not use third-party advertising or tracking cookies. The following categories of cookies are deployed:

You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies may impair the functionality of the Platform, including login and payment processing. Blocking analytical cookies will have no effect on your ability to use the Platform.

11 Your Rights

Subject to applicable law and the verification of your identity, you may exercise the following rights in relation to the personal data bk33cm holds about you:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how and why it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. Minor profile details (such as email address or contact number) can be updated directly within your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligation to retain certain categories of data for the periods described in Section 8.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, such as while a dispute about its accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including profiling for marketing purposes. Where you object to marketing communications, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected]. We will acknowledge your request within 48 hours and aim to provide a substantive response within 30 calendar days. In complex cases, this period may be extended by up to a further 30 days, of which we will notify you.

12 Minors

bk33cm's Platform is strictly intended for adults aged 18 and above. We do not knowingly collect personal data from any individual under the age of 18. Age verification is conducted as part of the KYC process prior to any withdrawal being processed. Where we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

13 Payment Data

bk33cm processes payment transactions through established and trusted payment service providers including bKash, Nagad, Rocket, Upay, and the Visa and Mastercard card networks. The handling of your payment credentials is governed by the following principles:

• bk33cm does not store full card numbers, CVV codes, or full mobile money PINs on its own servers. These credentials are transmitted directly to the relevant payment processor via an encrypted channel and are handled exclusively in accordance with that processor's security standards.
• bk33cm stores only the minimum payment metadata necessary to reconcile transactions, process withdrawals to the correct account, and comply with AML obligations — typically the last four digits of a card or the registered mobile number associated with a mobile money account.
• Deposits must originate from a payment account registered in the same name as the bk33cm account. Third-party deposits are not accepted. This rule exists to prevent money laundering and to ensure that withdrawals can be returned to the correct account holder.
• All payment transactions are logged with a timestamp, transaction reference, amount in BDT, payment method, and outcome (success/failure). These logs are retained in accordance with the financial record-keeping schedule in Section 8.

14 Marketing Communications

With your consent, bk33cm may send you promotional communications by email or SMS regarding new games, seasonal promotions (including Eid, Pohela Boishakh, BPL season offers, and ICC tournament specials), bonus offers, and platform news. Consent to receive marketing communications is obtained at the time of registration and is entirely optional — withholding or withdrawing consent has no effect on your ability to use the Platform.

You may withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email sent by bk33cm.
• Updating your communication preferences in the notifications section of your account settings.
• Sending a written request to [email protected] stating that you wish to be removed from all marketing lists.

Withdrawal of marketing consent will take effect within 5 business days of receipt. Please note that transactional communications — such as deposit confirmations, withdrawal notifications, account verification requests, and security alerts — are not marketing communications and will continue to be sent regardless of your marketing preferences.

15 Policy Changes

bk33cm reserves the right to amend this Privacy Policy at any time. Where a material change is made — for example, a new category of data is collected, a new category of third party is introduced, or the retention periods are altered — we will publish the updated Policy on this page with a revised "Last Updated" date and, where appropriate, send a notification to your registered email address or display an in-platform alert.

Your continued use of the Platform following the publication of an updated Policy constitutes your acknowledgement of the changes. We recommend bookmarking this page and reviewing it periodically. If you disagree with any amendment, you should discontinue use of the Platform and contact us to request account closure.

16 Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data-subject right, or wish to raise a data-related complaint, please contact our dedicated privacy support team using the details below. All correspondence should be in English.

We treat all privacy enquiries with strict confidentiality. Upon receipt of your message, a case reference number will be assigned and communicated to you. Please retain this reference number for follow-up correspondence.