Privacy Policy — How bdk1 Handles Your Personal Data

Introduction

This Privacy Policy ("Policy") describes how bdk1 ("bdk1", "we", "us", or "our") collects, processes, stores, and protects personal information provided by or obtained from users ("you", "Player", "User") who access the bdk1 website at https://bdk1.io and all associated services, games, betting markets, promotional features, and customer support channels (collectively, the "Platform").

bdk1 is committed to protecting the privacy and personal data of every player who uses our Platform. We recognise that trust is the foundation of any successful online relationship, and we take that responsibility seriously. This Policy has been written in clear, straightforward English so that every player — regardless of their technical background — can understand precisely how their data is handled.

This Privacy Policy forms part of, and should be read alongside, our Terms & Conditions and our Responsible Gaming Policy. By registering an account with bdk1 or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein.

Data Controller

For the purposes of applicable data protection law, bdk1 is the data controller responsible for the personal data collected through the Platform. As data controller, bdk1 determines the purposes for which your personal data is processed and the means by which that processing is carried out.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to contact our designated data protection contact, please reach us at:

• Email (Data Requests): [email protected] — subject line: "Privacy / Data Request"
• General Support: [email protected] — available 24/7 with responses within 4 hours (BST, UTC+6)
• Live Chat: Available directly on the Platform, 24 hours a day, 7 days a week

We aim to respond to all data-related requests within 30 calendar days of receipt. Where a request is particularly complex, we will notify you within the initial 30-day window and provide a revised timeline.

Data We Collect

bdk1 collects personal data from players in three broad categories: data you provide directly to us, data generated automatically through your use of the Platform, and data obtained from regulated third-party sources as part of our verification obligations.

3.1 — Data You Provide Directly

3.2 — Data Collected Automatically

3.3 — Data from Third-Party Sources

In fulfilment of our Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, bdk1 may receive supplementary identity verification data from regulated third-party verification services. This may include confirmation of your name, date of birth, and address against government databases or credit reference agencies. Such data is used solely for compliance purposes and is not shared with unrelated third parties.

How We Collect Your Data

bdk1 collects your personal data through the following channels and mechanisms:

• Registration form: When you create your bdk1 account, you voluntarily provide your name, date of birth, email address, phone number, and preferred payment method.
• KYC document upload: When identity verification is triggered, you upload scanned copies or photographs of your identity documents directly to our secure verification portal.
• Deposit and withdrawal transactions: Payment processing generates transaction records including your payment method reference number, transaction amount, timestamp, and transaction status.
• Gameplay activity: Our Platform automatically records every bet placed, game launched, session started, and game outcome associated with your account. This data forms part of your account history and is used for responsible gaming monitoring and dispute resolution.
• Customer support interactions: When you contact bdk1 via live chat or email, the full content of the conversation is recorded and associated with your account for quality assurance and complaint tracking purposes.
• Cookies and tracking technologies: As described in Section 10, cookies and similar technologies automatically collect technical and behavioural data each time you access the Platform.
• Third-party verification services: As described in Section 3.3, regulated identity verification partners may provide supplementary data to complete your KYC profile.

How We Use Your Personal Data

bdk1 uses the personal data we collect strictly for the purposes described in this Policy. We do not process your data for purposes that are incompatible with those stated here without first obtaining your additional consent. The primary purposes for which we use your data are:

• Account creation and management: Creating and maintaining your player account, authenticating your identity on login, processing account settings changes, and managing account closure or self-exclusion requests.
• Identity and age verification (KYC): Verifying that you are who you say you are and that you meet the minimum age requirement of 21 years. This is a legal and operational necessity — no account can be fully activated without passing our KYC process.
• Payment processing: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and partner banks, and maintaining an accurate transaction ledger for your account.
• Anti-money laundering (AML) compliance: Monitoring transaction patterns for signs of money laundering, fraud, structuring, or other financial crimes as required by applicable law. This may involve sharing flagged transaction data with relevant authorities where legally required.
• Responsible gaming: Analysing gameplay patterns to identify signs of problem gambling behaviour, enforcing deposit limits and session controls set by the player, and contacting players whose behaviour patterns suggest they may benefit from our responsible gaming tools.
• Customer support: Responding to your queries, resolving complaints, processing dispute requests, and providing you with account-related assistance.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, account takeovers, bonus abuse, collusion, and any other conduct that threatens the integrity of the Platform.
• Platform improvement: Analysing aggregate usage data to improve the performance, reliability, game selection, and user experience of the bdk1 Platform. Individual player data is anonymised before being used for analytical purposes wherever possible.
• Legal and regulatory compliance: Complying with applicable laws, regulations, court orders, and lawful government requests. bdk1 will retain certain data for the periods specified in Section 8 to fulfil statutory record-keeping obligations.
• Direct communications: Sending you transactional communications (account confirmations, deposit receipts, withdrawal notifications, security alerts) and, where you have opted in, promotional communications about bonuses, tournaments, and seasonal offers such as BPL, IPL, Eid, or Pohela Boishakh promotions.

Legal Basis for Processing

bdk1 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

Sharing & Disclosure of Your Data

bdk1 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share your data only in the limited circumstances described below, and always subject to appropriate data protection safeguards:

• Payment processors and mobile banking partners: When you make a deposit or request a withdrawal, your payment details are shared with the relevant payment service provider — such as bKash, Nagad, Rocket, Upay, or your bank — solely for the purpose of processing that transaction. These providers operate under their own privacy policies and are subject to their own regulatory obligations.
• KYC and identity verification partners: Regulated third-party KYC service providers receive a subset of your identity data (name, date of birth, document number) to perform verification checks against official databases. These partners are contractually bound to process your data only for verification purposes.
• Fraud detection and AML service providers: Specialised fraud prevention and anti-money laundering screening services may process your transaction data and behavioural patterns to identify risk signals. These services do not use your data for any purpose other than providing their screening service to bdk1.
• Game and technology providers: Third-party game studios such as Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, and Ezugi may receive a technical player identifier (not your real name or payment details) to deliver their game content and record the outcome of each game round. These providers operate under their own privacy and data security standards.
• Law enforcement and regulatory authorities: bdk1 may be required by law, court order, or lawful regulatory direction to disclose personal data to law enforcement agencies or regulatory bodies. We will comply with all such lawful requests and, where permitted, will notify the affected player of any such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of bdk1's assets, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it, prior to the transfer taking effect.

Data Retention

bdk1 retains your personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention schedule applies:

When your personal data is no longer required, bdk1 will securely delete or anonymise it in accordance with industry-standard data destruction practices. Anonymised, aggregated data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

Security Measures

bdk1 takes the security of your personal data extremely seriously. We have implemented a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or mobile device and bdk1's servers is encrypted using 256-bit SSL/TLS protocols — the same standard used by international financial institutions. Our certificate is verified and renewed regularly.
• Password hashing: Your account password is never stored in plain text. It is processed through a one-way cryptographic hashing algorithm (bcrypt with a high cost factor) before storage. Even bdk1 employees cannot view your plain-text password.
• Two-factor authentication (2FA): bdk1 offers optional two-factor authentication for all player accounts. We strongly recommend enabling 2FA through your account security settings. With 2FA active, a one-time code is required in addition to your password each time you log in from an unrecognised device.
• Access controls: Internal access to player data is strictly limited to bdk1 staff who have a legitimate operational need — for example, the customer support team, the KYC compliance team, and the payments team. All staff with data access receive mandatory data protection training and operate under confidentiality obligations.
• Infrastructure security: bdk1's servers are hosted in secure, access-controlled data centres with 24/7 physical security, redundant power supplies, and network-level intrusion detection systems. Routine security audits and penetration testing are conducted by independent third parties.
• Payment credential protection: bdk1 does not store full payment card numbers, bKash/Nagad PINs, or online banking passwords. All payment processing is handled by PCI-DSS-compliant payment partners.

While bdk1 employs industry-leading security practices, no system is entirely immune from all risks. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bdk1 will notify affected players without undue delay and will take all necessary steps to contain and remediate the breach.

Cookies & Tracking Technologies

The bdk1 Platform uses cookies and similar tracking technologies to provide a functional, secure, and personalised experience. A cookie is a small text file placed on your device by a website server. It cannot execute programs or deliver viruses; it is simply a data storage mechanism.

bdk1 uses the following categories of cookies:

Most browsers allow you to manage, block, or delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent certain core features of the bdk1 Platform — including secure login — from functioning correctly.

Your Privacy Rights

bdk1 respects and upholds your rights as a data subject. Depending on the legal basis on which your data is processed, you may be entitled to exercise some or all of the following rights:

• Right of Access: You have the right to request a copy of all personal data that bdk1 holds about you. We will provide this in a structured, readable format within 30 days of your verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic contact details directly through your account settings; for changes to identity documents, contact [email protected].
• Right to Erasure ("Right to Be Forgotten"): You may request that bdk1 delete your personal data. We will honour this request where we are not legally required to retain the data. Please note that AML and KYC records must be retained for a minimum of five years after account closure regardless of erasure requests, as this is a legal obligation.
• Right to Restrict Processing: You may request that bdk1 pause the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of that data is resolved.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you have the right to receive your personal data in a machine-readable format (such as CSV or JSON) and to have it transferred directly to another service provider where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where bdk1 relies on legitimate interests as its legal basis, and where you believe your interests, rights, or freedoms override bdk1's legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

To exercise any of the above rights, please send a request to [email protected] with the subject line "Data Rights Request — [Your Username]". We will verify your identity before processing any data rights request and will respond within 30 calendar days.

Minors & Age Policy

bdk1 operates exclusively for adults aged 21 years and above. The collection and processing of personal data from individuals under the age of 21 is strictly prohibited. Our Platform is not directed at, designed for, or intended to be used by minors, and we take all reasonable steps to prevent underage access.

As part of our registration and KYC process, every new player is required to confirm their date of birth and to provide valid government-issued identity documentation proving they are 21 or older. Accounts where age verification fails or is incomplete are suspended pending resolution and may not make deposits, place bets, or withdraw funds until full verification is achieved.

If bdk1 becomes aware — through KYC review, third-party verification, or any other means — that personal data has been collected from a player who is under 21 years of age, we will take the following immediate steps:

• Suspend the account and freeze all associated funds pending investigation.
• Permanently close the account and return any deposited funds to the payment source used, subject to applicable AML checks.
• Securely delete all personal data associated with the underage account, except where retention is required for legal or regulatory reasons.
• Record the incident in our compliance log and review how the underage player was able to pass initial registration checks.

If you are a parent or guardian and believe that a minor in your care has created an account on bdk1, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and respond within 24 hours.

International Data Transfers

bdk1 primarily processes and stores player data within secure data centre facilities. In certain circumstances — particularly where we engage third-party KYC verification providers, game studio technology partners, or cloud infrastructure services — your personal data may be transferred to and processed in countries outside Bangladesh.

Whenever personal data is transferred internationally, bdk1 ensures that appropriate safeguards are in place to protect your data to at least the same standard as described in this Policy. Such safeguards may include:

• Contractual clauses binding the recipient to process your data only in accordance with our instructions and applicable data protection standards.
• Transferring data only to entities in countries or jurisdictions that maintain an adequate level of data protection recognised by applicable international standards.
• Applying encryption and pseudonymisation to data prior to international transfer wherever technically feasible.

Where you have specific questions about the countries to which your data may be transferred, or the safeguards we apply to such transfers, please contact [email protected] and we will provide the relevant information within 30 days.

Changes to This Privacy Policy

bdk1 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, the services we offer, applicable legal requirements, or regulatory guidance. All changes are effective immediately upon publication on this page unless a later effective date is specified.

When we make material changes to this Policy — that is, changes that meaningfully affect your rights or how your data is processed — we will take at least one of the following steps to ensure you are informed:

• Display a prominent notice on the bdk1 Platform for a minimum of 14 days following the update.
• Send an email notification to the registered email address associated with your account.
• Display an in-Platform notification when you next log in, requiring acknowledgement of the updated Policy before proceeding.

The "Effective Date" displayed at the top of this page and in the table of contents sidebar will always reflect the date of the most recent revision. We strongly recommend that you review this page periodically to stay informed about how bdk1 protects your data. Continued use of the Platform after any changes to this Policy constitutes your acceptance of those changes.

Archived versions of previous Privacy Policies are available upon request by contacting [email protected].

Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way bdk1 handles your personal data, please do not hesitate to get in touch with us through any of the channels below. Our support team is available 24 hours a day, 7 days a week, and all data-related requests are handled with priority.

bdk1 is committed to resolving all privacy-related concerns fairly, transparently, and promptly. We treat every data request with the seriousness it deserves and will never penalise a player for exercising their legitimate privacy rights.