bk35 Privacy Policy — How We Protect Your Personal Data

1 Introduction

bk35 ("we", "us", "our") operates the online casino and sports betting platform available at https://bk35.io (the "Platform"). We are committed to protecting the privacy and personal data of all users ("you", "Player") who register and interact with the Platform, particularly those based in Bangladesh.

This Privacy Policy sets out:

• What categories of personal data we collect about you;
• The purposes for which we collect and process that data;
• The legal grounds on which we rely to process your data;
• How long we retain your data and under what conditions we delete it;
• Whether and with whom we share your data;
• Your rights in relation to your personal data and how to exercise them;
• How to contact us with privacy-related enquiries or complaints.

This Privacy Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform. In the event of a conflict between this Privacy Policy and the Terms & Conditions on a matter specifically relating to personal data, this Privacy Policy takes precedence.

2 Data We Collect

bk35 collects personal data in various categories depending on how you interact with the Platform. The table below provides a structured overview:

2.1 Data We Do Not Collect

bk35 does not collect or store the following categories of data, and our systems are designed to prevent their inadvertent capture:

• Full mobile wallet PINs or passwords for bKash, Nagad, Rocket, or any other payment provider;
• Full card numbers, CVV codes, or card expiry dates (card payments are processed by certified third-party payment gateways that handle this data directly);
• Biometric data such as fingerprints or facial recognition data;
• Sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or political opinions — except where a Player voluntarily discloses such information in a support communication, in which case it is used solely to assist with that specific query.

3 How We Collect Your Data

bk35 collects personal data through the following channels:

3.1 Direct Collection

You provide data directly to us when you:

• Register an account on the Platform, including entering your name, mobile number, and date of birth;
• Complete the KYC identity verification process by uploading government-issued identification documents;
• Make a deposit or request a withdrawal using bKash, Nagad, Rocket, Upay, or bank transfer;
• Contact bk35 customer support via email or the support ticket system;
• Participate in a promotion, tournament, or survey and provide additional details as required;
• Set responsible gaming preferences such as deposit limits or self-exclusion requests.

3.2 Automatic Collection

When you access and use the Platform, certain data is collected automatically through technical systems, including:

• Server access logs that record your IP address, device information, and the pages or game rooms you access;
• Session cookies and similar technologies that maintain your logged-in state and store your preferences;
• Analytics tools that track aggregate usage patterns across the Platform to help us improve performance and user experience.

3.3 Third-Party Sources

In limited circumstances, bk35 may receive data about you from third parties, including:

• Payment providers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card networks) confirming the successful completion or failure of a financial transaction;
• Identity verification service providers used to assist with KYC processes, who may cross-reference the identification documents you submit against authoritative databases;
• Game software providers (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi) whose platforms process game round data that is then reported back to bk35's systems for account balance and history purposes.

4 How We Use Your Data

bk35 uses the personal data it collects for the following specific purposes:

4.1 Account Registration and Management

Your identity and contact data are used to create and maintain your bk35 account, authenticate your login, process profile updates, and communicate important account notifications to your registered mobile number or email address.

4.2 Payment Processing

Financial data is used to process deposits credited to your account in BDT and to execute withdrawal requests to your registered payment method (bKash, Nagad, Rocket, or bank account). Transaction records are maintained for accounting, reconciliation, and audit purposes.

4.3 Identity Verification and Fraud Prevention

Identity data and financial data are used to verify that you are who you claim to be (KYC), to confirm that you meet the 21+ age requirement, to detect and prevent fraudulent account activity, bonus abuse, money laundering, and other prohibited behaviour as defined in our Terms & Conditions.

4.4 Regulatory and Legal Compliance

bk35 processes personal data where necessary to comply with applicable legal obligations, including anti-money-laundering (AML) requirements, law enforcement requests supported by appropriate legal authority, and any other regulatory obligations applicable to the operation of the Platform.

4.5 Platform Improvement and Analytics

Technical and usage data are processed in aggregate and anonymised form to understand how players interact with the Platform, identify performance bottlenecks, improve game loading speeds, and develop new features that better serve the Bangladesh market.

4.6 Customer Support

Communications data is used to handle your support queries, resolve disputes, track the history of your interactions with the bk35 support team, and improve our service quality over time.

4.7 Responsible Gaming

Responsible gaming data — including deposit limits, session alerts, and self-exclusion records — is used to enforce the protections you have requested, to monitor for indicators of problem gambling, and to proactively reach out to players who may benefit from support resources.

4.8 Direct Marketing

With your consent, bk35 may send you promotional communications about new games, seasonal offers (such as Eid or Pohela Boishakh promotions), and platform updates via your registered mobile number or email. You may opt out of marketing communications at any time by contacting [email protected]. Opting out of marketing will not affect the delivery of transactional or account-related communications.

5 Legal Basis for Processing

bk35 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Performance of a Contract: Processing necessary to provide the gaming services you have signed up for, including account management, payment processing, and game access.
• Legal Obligation: Processing required by applicable law, including KYC/AML obligations and responses to valid law enforcement requests.
• Legitimate Interests: Processing carried out for bk35's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

6 Data Sharing & Disclosure

bk35 does not sell your personal data. We share your data only in the limited circumstances described below:

6.1 Payment Providers

When you make a deposit or withdrawal, we share the minimum transaction data necessary with your chosen payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, or Mastercard) to process the transaction. These providers handle your payment data under their own privacy policies and security standards.

6.2 Identity Verification Partners

For KYC purposes, we may share your identification documents and personal details with accredited third-party identity verification services. These partners are contractually bound to process your data solely for the purpose of verifying your identity on bk35's behalf.

6.3 Game Software Providers

Game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi, and others) may receive a session token and minimal account reference data required to initialise a game session. They do not receive your full identity data, financial details, or contact information unless you interact with their support systems directly through features offered within the game.

6.4 Legal and Regulatory Authorities

bk35 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, a valid court order, or other legally binding authority. We will notify you of such disclosures where we are legally permitted to do so.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of bk35's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to the processing of your personal data that may result from it.

6.6 Professional Advisors

We may share personal data with lawyers, accountants, auditors, and other professional advisors where necessary for them to provide their services to bk35, subject to binding confidentiality obligations.

7 Data Retention

bk35 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or accounting obligations. The general retention periods that apply are as follows:

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Where data is anonymised rather than deleted, it may be retained indefinitely for aggregate statistical purposes.

8 Cookies & Tracking Technologies

bk35 uses cookies and similar technologies (collectively, "Cookies") on the Platform. Cookies are small data files placed on your device that help the Platform function correctly and allow us to understand how it is used.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in while you navigate between pages. These cannot be disabled without preventing you from using the Platform.
• Performance Cookies: Collect anonymised data on how players use the Platform — such as which pages load most slowly or which games are most frequently accessed. This data is used solely to improve Platform performance.
• Functional Cookies: Remember your preferences, such as your selected language or last-used payment method, to provide a more personalised experience.
• Analytical Cookies: Used internally to understand aggregate traffic patterns and session durations. bk35 does not use third-party behavioural advertising cookies that track your activity across external websites.

8.2 Managing Cookies

Most web browsers allow you to control cookie settings through the browser's privacy or settings menu. You can typically configure your browser to refuse all cookies, accept only certain types, or prompt you before accepting each cookie. Please note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features.

For guidance on managing cookies in common browsers, refer to the help documentation of your specific browser (e.g., Chrome, Firefox, Safari, or the default browser on your Android or iOS device).

9 Data Security

bk35 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in Transit: All data transmitted between your device and the bk35 Platform is encrypted using 256-bit SSL (TLS 1.2 or higher). This ensures that your login credentials, payment details, and personal data cannot be intercepted in transit.
• Encryption at Rest: Sensitive personal data stored in bk35's databases — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within bk35's internal systems is restricted to authorised employees and contractors who require access to perform their job functions. Access is granted on a least-privilege basis and reviewed regularly.
• Password Security: Player passwords are stored as salted cryptographic hashes — we cannot read your password, and no bk35 employee will ever ask you for it.
• Penetration Testing: bk35's Platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: bk35 maintains an incident response plan. In the event of a data breach that poses a risk to your rights, we will notify affected Players promptly and take immediate steps to contain and remediate the breach.

10 Your Privacy Rights

As a user of the bk35 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request":

10.1 Right of Access

You have the right to request a copy of the personal data bk35 holds about you, along with information about how it is being used. We will respond to valid access requests within 30 days.

10.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain data (such as your registered name or date of birth), we may require you to provide supporting documentation before making the correction.

10.3 Right to Erasure

You may request that bk35 delete your personal data in circumstances where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent (where consent was the legal basis); (c) you object to processing and there are no overriding legitimate grounds; or (d) the data has been processed unlawfully. Note that this right is subject to bk35's legal retention obligations — certain data must be retained for the periods described in Section 7 above regardless of an erasure request.

10.4 Right to Restrict Processing

You have the right to request that bk35 restrict the processing of your personal data — meaning we store it but do not actively use it — while a query about its accuracy or our right to process it is being resolved.

10.5 Right to Data Portability

Where processing is carried out by automated means and based on your consent or a contract, you may request that bk35 provide your personal data to you in a structured, commonly used, and machine-readable format.

10.6 Right to Object

You have the right to object to the processing of your personal data where that processing is based on bk35's legitimate interests. If you object, bk35 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests. You may also object at any time to processing of your data for direct marketing purposes, in which case we will stop immediately.

10.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

We will respond to all privacy rights requests within 30 days of receipt. In complex cases, we may extend this by a further 30 days, in which case we will notify you of the extension and the reason for it. We do not charge a fee for handling privacy rights requests unless they are manifestly unfounded or excessive.

11 Minors & Age Restriction

The bk35 Platform is strictly for adults aged 21 and above. We do not knowingly collect or process personal data from individuals under the age of 21. If you are under 21, you must not use the Platform or provide any personal data to bk35.

If bk35 discovers or is informed that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that your child has accessed bk35 and provided personal data, please contact us immediately at [email protected].

12 International Data Transfers

bk35 primarily serves players in Bangladesh, and our core data processing infrastructure is designed with this in mind. However, some of our third-party service providers — including cloud hosting providers, game software providers, and identity verification services — may operate servers located outside Bangladesh.

Where personal data is transferred to countries outside Bangladesh, bk35 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses in agreements with third-party processors that require them to handle your data with at least the same level of protection as bk35 applies;
• Selection of service providers who maintain internationally recognised security certifications (such as ISO 27001) and operate under robust data protection frameworks;
• Regular reviews of third-party data handling practices to ensure ongoing compliance with the standards described in this Privacy Policy.

By using the bk35 Platform and accepting this Privacy Policy, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh as described in this section.

13 Third-Party Services

The bk35 Platform integrates with a number of third-party services to deliver its full range of features. Each of these providers operates under its own privacy policy and data handling practices. bk35 is not responsible for the privacy practices of third-party services, and we encourage you to review their respective privacy policies where relevant.

13.1 Game Providers

Games hosted on the Platform are supplied by providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi. When you launch a game, a session token may be passed to the relevant provider to authenticate your game session. Game round results are reported back to bk35 to update your account balance and history.

13.2 Payment Processors

Deposits and withdrawals are processed via payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Your interaction with these payment systems is subject to those providers' own terms and privacy policies in addition to bk35's.

13.3 Analytics and Performance Tools

bk35 uses internal analytics tools to monitor Platform performance. Any third-party analytics components used are configured to anonymise IP addresses and are restricted from using your data for their own advertising or profiling purposes.

14 Changes to This Privacy Policy

bk35 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or the features and services offered on the Platform.

When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date displayed at the top of this page;
• Display a prominent notice on the Platform informing Players of the update;
• Where the changes materially affect how we process your personal data, send a notification to your registered email address or mobile number at least 14 days before the new version takes effect.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Privacy Policy, you should stop using the Platform and contact [email protected] to request account closure and data deletion in accordance with Section 10.3.

We recommend that you review this Privacy Policy periodically — at least once every six months — to remain informed of how bk35 is handling your personal data.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bk35 handles your personal data, please contact our privacy team using the details below:

• Email: [email protected]
• Subject Line: Privacy Rights Request — [Your Account Username]
• Response Time: Within 30 days of receiving your request
• Operating Hours: Sunday – Thursday, 09:00 – 21:00 BST (UTC+6)

Please include your registered username and a clear description of your request or concern to help us respond as efficiently as possible. We take all privacy enquiries seriously and are committed to resolving them promptly and transparently.