bk67 Privacy Policy — How We Handle Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how bk67 ("the Platform", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "the Player") who access or use any service provided through the bk67 website at https://bk67.io and all associated subdomains, mobile-optimised pages, and related digital properties.

bk67 is committed to handling personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. We recognise that players entrust us with sensitive personal and financial information, and we take that responsibility seriously. This Policy is written in plain English so that every player — regardless of technical background — can understand what data is collected and why.

This Policy should be read alongside the bk67 Terms & Conditions and the Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the platform. This Policy is effective from 1 January 2026.

2. Data Controller

For the purposes of this Policy, bk67 acts as the data controller in respect of all personal data collected from players who register and use the platform. As data controller, bk67 determines the purposes for which and the means by which personal data is processed. All enquiries relating to data privacy, data subject rights requests, or complaints about how your data is handled should be directed to the bk67 data privacy team at [email protected].

Where bk67 engages third-party service providers to process data on its behalf (for example, payment processors or KYC verification vendors), those third parties act as data processors and are contractually obligated to process data solely in accordance with bk67's documented instructions and to implement appropriate technical and organisational security measures.

3. Data We Collect

3.1 Registration Data

When you create a bk67 account, we collect the information you provide during the registration process. This includes your full legal name, date of birth, gender (where provided), residential address, email address, mobile phone number, and your chosen account username. This data is mandatory for account creation and is used to identify you as a unique player on the platform.

3.2 Identity Verification (KYC) Data

To comply with our anti-money laundering and responsible gaming obligations, and to protect the integrity of the platform, bk67 may request the following verification documents at any point during your use of the platform:

• A copy of a government-issued photo ID such as a National Identity Card (NID), passport, or driving licence.
• A recent proof of address document such as a utility bill, bank statement, or government-issued correspondence dated within the past 90 days.
• Proof of ownership of the payment method used for deposits, which may include a screenshot of your mobile banking account or a bank statement.
• A selfie photograph or short video for biometric identity confirmation, where required by the KYC verification process.

KYC documents are processed securely and are accessible only to authorised members of the bk67 compliance team and our contracted KYC verification provider. Documents are not shared with any other third party except where required by law.

3.3 Financial Transaction Data

Every deposit, withdrawal, bonus credit, and wagering transaction associated with your account is recorded by bk67. This includes the transaction type, amount in Bangladeshi Taka (BDT), timestamp, payment method used (bKash, Nagad, Rocket, Upay, bank transfer), and transaction reference number. This data is retained for financial reconciliation, fraud prevention, and regulatory compliance purposes.

3.4 Device and Technical Data

When you access bk67, we automatically collect technical information about the device and connection you are using. This includes your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and the pages you visit within the platform. This data is used to maintain platform security, detect suspicious activity, and improve the overall user experience.

3.5 Behavioural and Usage Data

bk67 collects data about how you interact with the platform, including the games you play, the frequency and duration of your sessions, the betting markets you browse, your deposit and withdrawal patterns, and your use of responsible gaming tools such as deposit limits and self-exclusion features. This data is used to personalise your experience, identify potential problem gambling behaviour, and improve the platform.

3.6 Communications Data

When you contact bk67 through live chat, email, or any other support channel, we retain a record of those communications, including the content of messages, timestamps, and the resolution applied. This data is used for quality assurance, training, and dispute resolution purposes.

3.7 Data Collected Automatically via Cookies

bk67 uses cookies and similar tracking technologies on the platform website. See Section 9 (Cookies & Tracking) for a full explanation of what cookies are set, why, and how you can manage them.

4. How We Use Your Data

bk67 uses the personal data it collects for the following purposes:

Purpose	Data Categories Used
Account creation and management	Registration data, KYC data
Processing deposits and withdrawals	Registration data, financial transaction data, KYC data
Identity verification and fraud prevention	KYC data, device data, financial transaction data
Anti-money laundering (AML) compliance	KYC data, financial transaction data, behavioural data
Responsible gaming monitoring	Behavioural data, registration data, financial transaction data
Platform security and abuse detection	Device data, behavioural data, communications data
Customer support and dispute resolution	Registration data, communications data, financial transaction data
Platform improvement and analytics	Behavioural data, device data, cookie data
Personalisation of game recommendations	Behavioural data, registration data
Legal and regulatory compliance	All categories as required

bk67 does not use your personal data to serve unsolicited third-party advertising or sell your data profile to data brokers, advertising networks, or marketing agencies.

5. Legal Basis for Processing

bk67 processes personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing your registration data, KYC documents, and financial transaction records is necessary to fulfil the contractual relationship between you and bk67 established when you created your account and accepted the Terms & Conditions.
• Legal obligation: Certain processing activities — particularly KYC verification and AML transaction monitoring — are required by applicable law and cannot be opted out of. Where bk67 is legally required to retain data or share it with authorities, it will do so regardless of any other instruction.
• Legitimate interests: bk67 processes device data, behavioural data, and security logs on the basis of its legitimate interest in maintaining a secure, fair, and well-functioning platform. These interests are balanced against your privacy rights and do not override them.
• Consent: Where bk67 processes optional data — such as analytics cookies or personalised game recommendations beyond what is required for platform operation — it does so on the basis of your consent. You may withdraw consent for these optional processing activities at any time without affecting the core functionality of your account.

6. Sharing Your Data

bk67 does not sell, rent, or trade your personal data. Data is shared with third parties only in the following limited and controlled circumstances:

6.1 Payment Service Providers

To process deposits and withdrawals, bk67 shares the minimum necessary account and transaction data with its payment processing partners, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. These providers are independent data controllers in respect of payments you make through their own platforms and are subject to their own privacy policies and regulatory obligations.

6.2 KYC and Identity Verification Providers

bk67 uses contracted third-party KYC verification vendors to assist with identity document verification and biometric checks. These providers process identity documents solely for the purpose of verifying your identity on behalf of bk67 and are contractually prohibited from using your data for any other purpose.

6.3 Game Software Providers

When you play games on the bk67 platform supplied by third-party providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, a pseudonymised player identifier and session token may be transmitted to the relevant game server to enable gameplay. Full personal details are not shared with game providers.

6.4 Legal and Regulatory Authorities

bk67 may disclose personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where it is required or permitted to do so by applicable law, a court order, or other binding legal process. In such cases bk67 will endeavour to notify the affected player where it is legally permitted to do so.

6.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of bk67's business, personal data held by the platform may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity assuming the obligations of this Policy in respect of that data.

7. Data Retention

bk67 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal retention requirements, and to resolve disputes or enforce agreements. The following general retention principles apply:

• Active account data is retained for the lifetime of your bk67 account and for a minimum period of five (5) years following account closure, to meet anti-money laundering record-keeping obligations.
• KYC and identity verification documents are retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later.
• Financial transaction records are retained for a minimum of seven (7) years to satisfy financial record-keeping requirements.
• Customer support communications are retained for a period of three (3) years from the date of the relevant interaction.
• Analytics and behavioural data collected via cookies or session tracking is retained for a maximum of thirteen (13) months from the date of collection, after which it is aggregated or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

8. Security

bk67 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security controls currently in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or app and bk67 servers.
• Encryption of sensitive data at rest, including identity documents and payment details, using industry-standard cryptographic algorithms.
• Role-based access controls that restrict access to personal data to only those members of the bk67 team who require it to perform their job function.
• Regular security audits and penetration testing of the platform infrastructure.
• Two-factor authentication (2FA) options for player accounts to provide an additional layer of login security.
• Continuous monitoring of platform activity for signs of unauthorised access, fraud, or data exfiltration.

While bk67 takes all reasonable steps to protect your data, no system can be guaranteed to be entirely secure. You are responsible for maintaining the security of your own device and account credentials. If you believe your account has been compromised, please contact bk67 support immediately at [email protected].

9. Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They serve a variety of functions, from keeping you logged in during a session to helping the platform understand how visitors use its features. bk67 uses both first-party cookies (set directly by bk67) and third-party cookies (set by contracted analytics and security providers).

9.2 Types of Cookies Used by bk67

• Strictly Necessary Cookies: These cookies are essential for the bk67 platform to function. They maintain your login session, remember your currency and language preferences, and ensure the security of your interactions with the platform. You cannot opt out of strictly necessary cookies without losing core platform functionality.
• Analytics Cookies: bk67 uses analytics cookies to collect aggregated, anonymised data about how players navigate and use the platform. This data helps the bk67 product team understand which features are most used, identify areas for improvement, and measure the effectiveness of platform updates. These cookies are optional.
• Security Cookies: bk67 uses security and fraud-detection cookies to identify and flag unusual browsing patterns, detect automated bot activity, and protect the integrity of the platform and its players. These cookies are strictly necessary for platform security purposes.

9.3 Managing Cookies

You can manage or disable optional cookies through your browser settings at any time. Most modern browsers allow you to view, manage, and delete cookies via the browser's privacy or settings menu. Please note that disabling certain cookies may affect the performance or functionality of the bk67 platform. Disabling strictly necessary cookies may prevent you from logging in or using the platform at all.

10. Your Data Rights

As a data subject, you hold the following rights in respect of the personal data bk67 holds about you. To exercise any of these rights, please submit a written request to [email protected] from the email address registered to your bk67 account. bk67 will acknowledge your request within 72 hours and aim to provide a full response within 30 days.

• Right of Access: You have the right to request a copy of all personal data bk67 holds about you, along with information about how it is processed and with whom it has been shared.
• Right to Rectification: If any personal data bk67 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account information directly through your account dashboard.
• Right to Erasure: In certain circumstances you may request that bk67 delete your personal data. This right is not absolute — where bk67 is legally required to retain data (for example, for AML compliance), it cannot comply with an erasure request in respect of that data. bk67 will inform you of any such limitations when responding to your request.
• Right to Restriction of Processing: You may request that bk67 restrict the processing of your data in specific circumstances, for example while a rectification request is being assessed, or where you have objected to processing and the outcome of that objection is pending.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive a copy of the data you provided to bk67 in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data that is carried out on the basis of bk67's legitimate interests. bk67 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

11. Minors and Under-21 Policy

The bk67 platform is strictly intended for adults aged 21 years and over. bk67 does not knowingly collect, process, or store personal data relating to individuals under the age of 21. If bk67 becomes aware or has reasonable grounds to believe that a registered account holder is under 21, it will immediately suspend the account, initiate an investigation, and — where the account holder is confirmed to be under 21 — permanently close the account and delete associated personal data to the extent permitted by applicable legal retention obligations.

If you are a parent or guardian and believe that a minor in your care has registered an account on bk67, please contact us immediately at [email protected] so that we can take appropriate action.

12. International Data Transfers

bk67 is an offshore-operated platform. This means that your personal data may be transferred to, stored on, and processed by servers and service providers located outside Bangladesh. Where such international transfers occur, bk67 takes steps to ensure that adequate levels of data protection are maintained, including implementing contractual safeguards with data processors in the form of standard data processing agreements that impose equivalent data protection obligations on those processors.

By using the bk67 platform and accepting this Privacy Policy, you consent to the transfer of your personal data to jurisdictions outside Bangladesh where bk67's servers, service providers, and contracted processors are located, subject to the safeguards described above.

13. Policy Amendments

bk67 reserves the right to update or amend this Privacy Policy at any time to reflect changes in its data processing practices, applicable law, or the structure of the platform. Where a material change is made to this Policy, bk67 will notify registered players via the platform website or by email to their registered address at least 14 days before the change takes effect, except where a shorter notice period is required by law. Your continued use of the bk67 platform following the effective date of any amended Policy constitutes your acceptance of the updated terms.

The "Effective" date displayed at the top of this document indicates when the current version of the Policy came into force. Previous versions of this Policy are available on request by contacting [email protected].

14. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or the way bk67 handles your personal data, or if you wish to exercise any of your data subject rights as described in Section 10, please contact the bk67 privacy team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the bk67 platform website
• Response Time: bk67 aims to respond to all privacy-related enquiries within 72 hours (Bangladesh Standard Time, UTC+6)

For concerns specifically related to responsible gaming, deposit limits, self-exclusion, or problem gambling support, please visit the Responsible Gaming page where additional guidance and self-help tools are available.