bbok Privacy Policy — How We Protect Your Personal Data

bbok ("bbok", "we", "us", "our") is committed to protecting the privacy of every individual who accesses or uses the bbok.io platform. This Privacy Policy describes how bbok collects, stores, processes, and protects the personal data of its registered players and website visitors in the context of providing an online gaming and sports betting service to the Bangladesh market.

This policy is written in English and is intended to be clearly understandable to all bbok users. It sets out your rights with respect to your personal data and explains how you may exercise those rights at any time throughout the lifetime of your bbok account.

bbok operates its platform in English and processes all player transactions in Bangladeshi Taka (৳ BDT). The personal data practices described in this policy apply to all players accessing bbok.io from Bangladesh, including those in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar, as well as players accessing the platform from other regions.

By registering a bbok account, depositing funds, placing a wager, or otherwise engaging with any bbok product or service, you acknowledge that you have read this Privacy Policy in its entirety and that you consent to the data practices described herein. Where consent is required for a specific processing activity, bbok will seek that consent separately and explicitly.

bbok collects personal data from you in three ways: data you provide directly during registration and account use; data generated automatically as a result of your use of the platform; and data received from authorised third-party partners such as KYC verification services and payment processors. The following table summarises the categories of data collected.

bbok uses the personal data it collects for specific, defined purposes only. We do not use your data for purposes that are incompatible with the original reason it was collected. The primary purposes for which bbok processes personal data are as follows:

• Account Registration and Management: To create and maintain your bbok player account, verify your identity, enforce the minimum age of 21, and ensure that only one account exists per individual.
• Payment Processing: To facilitate deposits to and withdrawals from your bbok BDT wallet via bKash, Nagad, Rocket, and Upay; to reconcile transactions; and to detect and prevent fraudulent payment activity.
• KYC and Anti-Money Laundering Compliance: To verify player identity and source of funds in accordance with anti-money laundering best practices; to maintain records required for compliance purposes.
• Responsible Gaming: To monitor player behaviour for signs of problem gambling; to enforce deposit limits, cooling-off periods, and self-exclusion requests; and to comply with responsible gaming obligations.
• Platform Security: To detect and prevent fraud, collusion, multi-accounting, use of automated betting software, and other forms of prohibited conduct described in the bbok Terms & Conditions.
• Customer Support: To respond to queries, investigate disputes, process account closure requests, and communicate material changes to platform policies to registered players.
• Platform Improvement: To analyse aggregate, anonymised usage patterns in order to improve the performance, reliability, and user experience of the bbok platform. This analysis does not involve the processing of individually identifiable data.
• Marketing Communications: To send promotional offers, bonus notifications, and seasonal campaign information to players who have provided explicit consent to receive such communications. Players may withdraw this consent at any time.

For each category of personal data processed by bbok, there is a defined legal basis. bbok relies on the following legal bases for processing, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform the contract between bbok and the player — including account creation, deposit/withdrawal processing, and bet settlement — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legitimate Interests: Where processing is necessary for bbok's legitimate business interests — including platform security, fraud prevention, anti-money laundering controls, and internal analytics — and those interests are not outweighed by your data protection rights. bbok has conducted internal assessments to confirm that all processing carried out under this basis is proportionate and necessary.
• Legal Obligation: Where processing is required for bbok to comply with applicable legal obligations, including KYC requirements, anti-money laundering record-keeping, and responding to lawful requests from competent authorities.
• Consent: Where bbok relies on your explicit consent to process personal data — most notably for the sending of marketing communications — that consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

bbok does not sell, rent, or trade your personal data to any third party. Data is shared with external parties only where strictly necessary for the operation of the platform, under the following controlled circumstances:

• KYC and Identity Verification Partners: bbok works with authorised identity verification providers to confirm player age and identity as part of the account registration and KYC process. These partners process only the data necessary for verification and are bound by strict data processing agreements that prohibit them from using your data for any other purpose.
• Payment Processors: Transaction data is shared with mobile financial service operators (bKash, Nagad, Rocket, Upay) as necessary to process deposits and withdrawals. bbok does not share more data with payment processors than is required to complete the specific transaction.
• Game Technology Providers: When you play games hosted by third-party studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — certain gameplay data (such as session token, game result, and stake amount) is shared with those studios for the purpose of game delivery and result certification. Personal identity data is not transmitted to game studios.
• Legal and Regulatory Authorities: bbok may be required to disclose personal data to competent authorities, law enforcement agencies, or courts of law where compelled to do so by a lawful order. bbok will notify the affected player of such a disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of bbok's business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified in advance of such a transfer and of any changes to data processing arrangements that would result from it.

bbok uses cookies and similar tracking technologies on the bbok.io website to ensure the platform functions correctly, to maintain your login session, and to understand how players interact with the site in aggregate. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the bbok platform to function. They maintain your logged-in session, store your language and currency preferences (English / ৳ BDT), and enable core features such as the bet slip and wallet balance display. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: These cookies remember your preferences and personalisation settings — such as your preferred sports markets or recently played games — to improve your experience on return visits. They do not track you across third-party websites.
• Analytics Cookies: bbok uses privacy-respecting analytics tools to collect aggregate, anonymised data about how players navigate the site — including which pages are visited most frequently and where users encounter difficulties. This data is used solely to improve platform design and performance. Individual players are not identified through this data.
• Security Cookies: These cookies support fraud detection and account security functions. They help bbok identify unusual login patterns, detect the use of automated scripts, and protect player accounts from unauthorised access.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from using core platform features including account login, deposits, and game play. bbok does not use third-party advertising or retargeting cookies.

bbok retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or to meet applicable legal and compliance obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted from bbok's systems or irreversibly anonymised so that it can no longer be linked to an individual player. Players who request account closure should be aware that certain data categories must be retained for the periods specified above regardless of closure, in order to comply with legal obligations.

bbok implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls in place include:

• TLS Encryption in Transit: All data transmitted between your browser or mobile device and bbok.io is encrypted using TLS 1.2 or higher. Connections using older, insecure protocol versions are rejected.
• AES-256 Encryption at Rest: Personal data stored on bbok's servers — including identity data, KYC documents, and financial records — is encrypted using AES-256, which is the same standard used by major international financial institutions.
• Access Controls: Access to systems containing personal data is restricted to bbok staff who have a legitimate operational need. All access is logged, and access rights are reviewed periodically. Former staff have their access credentials revoked immediately upon departure.
• Two-Factor Authentication: All internal bbok staff accounts used to access player data require two-factor authentication (2FA). bbok also offers 2FA to players for their own account login security where this feature is available on the platform.
• Vulnerability Management: bbok conducts regular security assessments of its platform, including penetration testing by independent security professionals. Identified vulnerabilities are remediated according to their severity within defined timelines.
• Incident Response: bbok maintains an internal data breach response plan. In the event of a personal data breach that poses a risk to affected players, bbok will notify impacted users without undue delay and take all reasonable steps to contain and remediate the breach.

As a bbok player, you have the following rights with respect to your personal data. To exercise any of these rights, contact bbok at [email protected] with the subject line "Data Rights Request". bbok will acknowledge your request within 48 hours and fulfil it within 7 business days, subject to identity verification.

bbok will not charge a fee for exercising any of these rights in ordinary circumstances. Where a request is manifestly unfounded or excessive — for example, where the same request is repeated multiple times within a short period — bbok reserves the right to charge a reasonable administrative fee or decline to act on the request, with a written explanation provided to the requesting player.

Where bbok is unable to fulfil a rights request in full — for example, because doing so would conflict with a legal retention obligation — bbok will explain the specific reason in writing and describe any alternative remedy available to you.

The bbok platform is strictly intended for adults aged 21 and above. bbok does not knowingly collect, process, or store personal data belonging to individuals under the age of 21. The age of 21 is the minimum required to register an account, make a deposit, or place any wager on the bbok platform.

During the account registration process, all players are required to confirm that they meet the minimum age requirement of 21. bbok's KYC process includes date-of-birth verification against a government-issued identity document. Any account found to have been registered by a person under the age of 21 will be suspended immediately, all funds will be frozen pending investigation, and the matter will be escalated for further review in accordance with bbok's responsible gaming procedures.

If you are a parent or guardian and believe that a minor in your care has registered a bbok account, please contact bbok immediately at [email protected] with the subject line "Underage Account Report". bbok will treat such reports as a priority and investigate them within 24 hours of receipt.

bbok may send you promotional emails, SMS messages, or in-platform notifications about bonuses, seasonal campaigns (such as Eid promotions, Pohela Boishakh offers, or BPL tournament specials), and new game releases — but only if you have explicitly consented to receive such communications during or after registration.

You may withdraw your consent to receive marketing communications at any time through any of the following methods:

• Clicking the "Unsubscribe" link included at the bottom of every bbok promotional email.
• Updating your communication preferences in the notifications section of your bbok account settings.
• Contacting bbok support at [email protected] with the subject line "Unsubscribe from Marketing".

Withdrawal of marketing consent will be processed within 5 business days. Please note that even after withdrawing marketing consent, bbok may still send you transactional and service-related communications — such as deposit confirmations, withdrawal notifications, security alerts, and policy update notices. These communications are not marketing in nature and do not require your consent, as they relate directly to the operation of your account.

bbok does not share your contact details with third-party advertisers for the purpose of sending you marketing from unrelated brands. Any co-branded promotions involving partner organisations will be clearly identified as such, and your data will not be passed to the co-branding partner without your explicit consent.

bbok reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or platform features. When material changes are made to this policy, bbok will notify registered players via email or via a prominent notice on the bbok.io platform at least 14 days before the changes take effect.

The updated Privacy Policy will always be accessible at bbok.io/privacy-policy. The "Last Updated" date at the top of this document will be revised each time the policy is amended. We encourage you to review this page periodically so that you remain informed of how bbok handles your personal data.

Your continued use of the bbok platform after a revised Privacy Policy has taken effect constitutes your acceptance of the updated policy. If you do not agree with the changes, you should cease using the platform and contact bbok to request account closure. bbok will process your closure request in accordance with the applicable retention periods described in Section 7 of this policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to bbok's personal data practices, please contact the bbok Privacy team using the details below. All correspondence must be submitted in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Rights Requests: "Data Rights Request — [Your Full Name]"
• Subject Line for Privacy Queries: "Privacy Policy Query"
• Response Time: Within 48 hours on business days (Bangladesh Standard Time, UTC+6).
• Operating Hours: Monday to Sunday, 09:00 – 22:00 BST (UTC+6)

For urgent matters relating to a suspected personal data breach, unauthorised account access, or an underage account report, please mark your email subject line accordingly so that your query is escalated to the appropriate team without delay.