bdoak Privacy Policy — How We Handle Your Personal Data

Effective: 1 January 2026  |  Last Updated: 1 January 2026

1. Introduction & Scope

This Privacy Policy ("Policy") describes how bdoak ("bdoak", "we", "us", "our"), the operator of the online betting and gaming platform at bd oak.io, collects, uses, stores, and protects the personal data of individuals who access or use our platform ("you", "your", "the Player"). This Policy applies to all personal data processed in connection with your use of bdoak's services, including cricket betting, live casino, slots, fishing games, and all associated account management functions.

By registering an account on bdoak or continuing to use the platform after this Policy has been published or updated, you acknowledge that you have read and understood how we handle your personal data. If you do not agree with the practices described in this Policy, please discontinue use of the platform and contact us to close your account.

This Policy should be read alongside bdoak's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Data Controller

bdoak acts as the data controller in respect of the personal data collected through the bdoak platform. As data controller, bdoak determines the purposes and means by which your personal data is processed. All data protection queries, access requests, and erasure requests should be directed to our support team using the contact details in Section 15 of this Policy.

3. Personal Data We Collect

The categories of personal data that bdoak may collect from you include, but are not limited to, the following:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, national ID number, passport number	Account registration, age verification, KYC compliance
Contact Data	Email address, mobile phone number, city/district of residence	Account communications, support responses, security alerts
Financial Data	bKash/Nagad/Rocket mobile account number, transaction reference IDs, deposit and withdrawal amounts in BDT	Payment processing, fraud prevention, AML compliance
Technical Data	IP address, device type, browser type, operating system, session duration, pages visited	Platform security, performance monitoring, fraud detection
Usage Data	Betting history, game session data, bonus activity, login timestamps	Account management, responsible gaming monitoring, dispute resolution
Communications Data	Live chat transcripts, support email content, survey responses	Customer support, quality assurance, training
Verification Documents	Copies of NID, passport, or other identity documents submitted for KYC	Age and identity verification, regulatory compliance

We do not intentionally collect special category data (such as health information, religious beliefs, or political opinions) from our players. If you choose to share such information voluntarily — for example, when requesting a self-exclusion on health grounds — it will be handled with the highest level of care and used solely for the purpose for which it was provided.

4. How We Collect Your Data

bdoak collects your personal data through the following means:

• Direct interactions: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or responding to surveys.
• Automated technologies: Technical data collected automatically when you access the platform, including IP address, device identifiers, cookies, and session logs. See Section 11 for more detail on cookies.
• Third-party sources: Identity and fraud-screening data received from payment providers (bKash, Nagad, Rocket, Upay) and identity verification service providers. This data is collected only where necessary and in accordance with those providers' own privacy notices.
• Game providers: Aggregated game session data (bet amounts, RTP outcomes, session duration) provided by our licensed game providers, including Pragmatic Play, Evolution Gaming, Spribe, and Ezugi, for the purpose of account management and dispute resolution.

5. Legal Basis for Processing

bdoak processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — that is, to operate your account, accept deposits, settle bets, and process withdrawals.
• Legal obligation: Processing required to comply with applicable law, including anti-money-laundering (AML) regulations, know-your-customer (KYC) requirements, and fraud prevention obligations.
• Legitimate interests: Processing necessary for bdoak's legitimate interests, including platform security, fraud detection, responsible gaming monitoring, and improving our services — where those interests are not overridden by your data protection rights.
• Consent: Where you have given specific, informed consent for optional processing activities, such as receiving promotional communications from bdoak. You may withdraw this consent at any time by updating your account preferences or contacting support.

6. How We Use Your Data

bdoak uses your personal data for the following specific purposes:

• To create, verify, and manage your bdoak account throughout its lifetime.
• To process deposits and withdrawals via bKash, Nagad, Rocket, and Upay securely and without delay.
• To verify your identity and age in compliance with our 21+ age restriction policy and applicable KYC obligations.
• To detect and prevent fraud, money laundering, collusion, and other prohibited activities described in our Terms & Conditions.
• To monitor your gaming activity for responsible gaming purposes, including identifying signs of problem gambling and applying self-imposed account restrictions.
• To respond to support queries, resolve disputes, and maintain records of customer interactions for quality assurance.
• To send you transactional communications, including account statements, deposit confirmations, withdrawal notifications, and security alerts.
• To send promotional communications about bdoak bonuses and offers, where you have given explicit consent or where permitted by applicable law. You may opt out at any time.
• To improve the performance, reliability, and features of the bdoak platform through anonymised analytics and testing.
• To comply with court orders, regulatory requests, and other legal obligations.

7. Sharing Your Data

bdoak does not sell your personal data to third parties. We share your data only in the following limited circumstances:

Service Providers

We share data with trusted third-party service providers who perform functions on our behalf, including payment processors (bKash, Nagad, Rocket), identity verification providers, cloud hosting and infrastructure providers, and customer support platforms. All service providers are bound by data processing agreements that require them to handle your data only as instructed by bdoak and in accordance with applicable law.

Game Providers

To facilitate game play, limited session and account data is transmitted to our licensed game providers — including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming — solely for the purpose of delivering the game experience and resolving game disputes. Game providers do not receive financial data beyond what is required to process in-game transactions.

Legal & Regulatory Disclosure

bdoak may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

Business Transfers

In the event that bdoak undergoes a merger, acquisition, or sale of all or a substantial part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the acquiring entity will be required to honour the terms of this Policy.

8. International Data Transfers

Some of bdoak's service providers and game providers operate servers located outside Bangladesh. Where your personal data is transferred to a country that may not offer an equivalent level of data protection to that available in Bangladesh, bdoak takes appropriate safeguards to ensure your data remains protected. These safeguards include entering into data transfer agreements with receiving parties that incorporate standard contractual clauses and require the receiving party to implement adequate technical and organisational security measures.

9. Data Retention

bdoak retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account's active status and for a minimum of 5 years after account closure, in accordance with AML record-keeping requirements.
• Financial transaction data: Retained for a minimum of 5 years following the date of the transaction, as required for audit and compliance purposes.
• Communication and support data: Retained for 3 years after the date of the interaction, or for the duration of any related dispute, whichever is longer.
• Technical and usage data: Anonymised or deleted after 24 months unless a specific investigation requires extended retention.
• KYC verification documents: Retained for a minimum of 5 years after account closure or the date the document was submitted, whichever is later.

After the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identified or identifiable individual.

10. Security Measures

bdoak implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• TLS/SSL encryption for all data in transit between your device and the bdoak platform.
• Encryption or one-way hashing of sensitive stored data, including passwords and payment credentials.
• Role-based access controls that restrict access to personal data to bdoak staff members who have a legitimate business need to process it.
• Regular security audits, penetration testing, and vulnerability assessments of the platform infrastructure.
• Incident response procedures that require bdoak to notify affected players and relevant authorities in the event of a data breach that poses a risk to players' rights and freedoms.
• Staff training on data protection obligations and secure data handling practices.

11. Cookies & Tracking Technologies

bdoak uses cookies and similar browser-based storage technologies to deliver a reliable, personalised platform experience. Cookies are small text files stored on your device when you visit the bdoak website. The types of cookies we use are:

• Strictly necessary cookies: Required for the platform to function. These cookies maintain your login session, remember your language preference, and enable the shopping cart and payment flow. They cannot be disabled without impairing your ability to use the platform.
• Performance cookies: Collect anonymised information about how players use the platform — for example, which pages are visited most frequently and whether error messages are displayed — to help us improve the platform experience.
• Functional cookies: Remember your preferences, such as preferred sports markets, game lobby filters, and notification settings, so you do not need to re-configure them on each visit.

bdoak does not use third-party advertising cookies or cross-site tracking cookies. You can control and delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies may affect your ability to log in and use the platform.

12. Your Rights

As a data subject, you have the following rights in respect of the personal data that bdoak holds about you:

• Right of access: You may request a copy of the personal data bdoak holds about you, along with information about how it is being used.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data held about you.
• Right to erasure: You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain data (see Section 9).
• Right to restriction: You may request that we restrict the processing of your data in certain circumstances — for example, while a correction request is being assessed.
• Right to object: You may object to the processing of your personal data where we rely on legitimate interests as our legal basis, or where your data is used for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to data portability: You may request that we provide your personal data in a structured, commonly used, and machine-readable format so that you can transfer it to another service provider.

To exercise any of these rights, please contact bdoak support using the details in Section 15. We will respond to all verified requests within 30 days of receipt. In some cases, we may need to verify your identity before processing a request.

13. Children's Privacy

The bdoak platform is strictly for adults aged 21 and above. bdoak does not knowingly collect personal data from individuals under the age of 21. If we become aware that we have inadvertently collected data from a person under the minimum age, we will delete that data immediately and close the associated account. If you believe a minor has registered on bdoak, please notify us at [email protected] so we can take prompt action.

14. Changes to This Policy

bdoak reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. When material changes are made, we will notify registered players by email and/or by posting a prominent notice on the platform at least 7 days before the changes take effect. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of bdoak following the effective date of any update constitutes your acceptance of the revised Policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bdoak handles your personal data, please contact our Data Protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the bdoak platform — average response time 2–5 minutes
• Formal written requests: Please submit formal data subject access requests, erasure requests, and correction requests in English via email to the address above. Include your full registered name and the email address associated with your bdoak account so we can verify your identity before processing the request.

We aim to respond to all data-related queries within 5 business days and to complete formal data subject requests within 30 days of receipt and identity verification.