bck33 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how bck33 ("bck33", "we", "us", "our") collects, uses, stores, shares, and protects personal data provided by players and visitors ("you", "your") who access or use the bck33 online gaming and sports betting platform at bck33.io. This Policy forms an integral part of the bck33 Terms and Conditions and should be read alongside them.

bck33 is committed to handling personal data responsibly and transparently. We process personal data only for clearly defined purposes, retain it only for as long as necessary, and implement robust technical and organisational safeguards to keep it secure. Our platform serves players across Bangladesh — including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh — and we are mindful of our obligations to those players in relation to their data privacy.

2 Data We Collect

bck33 collects personal data in several ways: directly from you when you register or interact with the platform, automatically through your use of the platform, and in some cases from third-party identity verification and payment service providers. The categories of personal data we collect include:

2.1 Registration & Identity Data

• Full legal name as it appears on official identity documents
• Date of birth (required to verify the 21+ age requirement)
• Residential address, including city and postcode
• Email address and mobile phone number
• Username and account credentials (password stored in hashed form only)
• Copies of identity documents submitted during KYC verification (national ID, passport, driving licence)
• Proof of address documents (utility bills, bank statements, mobile financial service statements)

2.2 Financial & Transaction Data

• Mobile financial service account numbers (bKash, Nagad, Rocket, Upay) used for deposits and withdrawals
• Card details (Visa, Mastercard) — processed through encrypted payment gateways; bck33 does not store full card numbers
• Deposit and withdrawal transaction history, including amounts in Bangladeshi Taka (BDT)
• Bonus and promotional credit records

2.3 Platform Usage Data

• Betting and gaming activity: markets wagered on, stakes placed, game sessions, win/loss records
• Login timestamps, session duration, and frequency of access
• Responsible gaming tool usage (deposit limits set, cool-off activations, self-exclusion requests)
• Customer support interactions, including chat transcripts and email correspondence

2.4 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type/version
• Referring URL and on-site navigation path
• Cookie identifiers and session tokens (see Section 7)

3 How We Use Your Data

bck33 uses the personal data we collect for the following purposes:

bck33 does not use personal data for automated individual decision-making that produces significant legal effects, except in the context of fraud detection and AML screening, where decisions may be reviewed by a qualified member of our compliance team prior to any account action being taken.

4 Legal Basis for Processing

bck33 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the bck33 Terms and Conditions — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including Know Your Customer (KYC), Anti-Money Laundering (AML), and counter-fraud obligations.
• Legitimate Interests: Processing carried out to pursue bck33's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and personalised promotional offers, where you have provided explicit opt-in consent. You may withdraw this consent at any time by contacting [email protected] or adjusting your account communication preferences.

5 Data Sharing & Disclosure

bck33 does not sell, rent, or trade personal data to third parties. We share personal data only in the following limited circumstances, and only to the extent strictly necessary for each purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transaction-specific data necessary to process deposits and withdrawals. These providers operate under their own privacy policies and are independently certified payment platforms.
• Identity Verification Partners: Third-party KYC/AML service providers may receive copies of identity documents and personal details to perform verification checks on behalf of bck33. These partners are contractually bound to data protection standards equivalent to those applied by bck33.
• Game Content Providers: Providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive anonymised session-level data for game functionality purposes. These providers do not receive individually identifiable player data for marketing purposes.
• Legal and Regulatory Authorities: bck33 may disclose personal data to competent legal or regulatory authorities where required by law, court order, or valid legal process — for example, in connection with fraud investigations, money laundering reports, or regulatory audits.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale involving bck33, personal data held by bck33 may be transferred to the acquiring entity, subject to equivalent data protection commitments being maintained by the successor entity.

In all cases where personal data is shared with third parties, bck33 implements appropriate data sharing agreements and due diligence procedures to ensure the continued protection of your information.

6 Payment Data

bck33 takes the protection of financial data with particular seriousness. All deposit and withdrawal transactions on the bck33 platform are processed through encrypted payment gateways operated by our payment service providers. The following specific protections apply to payment data:

• bck33 does not store full card numbers (Primary Account Numbers) on its own servers. Card transaction data is tokenised at the point of entry and processed exclusively within the payment provider's certified environment.
• Mobile financial service account numbers (bKash, Nagad, Rocket, Upay) are stored in encrypted form and are accessible only to authorised payment processing systems.
• All payment data is transmitted over TLS 1.2 or higher encrypted connections.
• bck33 applies a strict data minimisation principle to payment data — we retain only the transaction records necessary for accounting, dispute resolution, and AML compliance purposes.
• Payment data is never shared with game content providers, marketing partners, or any third party not directly involved in the transaction processing chain.

7 Cookies & Tracking Technologies

bck33 uses cookies and similar browser-based tracking technologies to support the operation of the platform, maintain your session state, and understand how players engage with our services. The types of cookies bck33 uses are as follows:

bck33 does not use third-party advertising cookies, behavioural targeting cookies, or cross-site tracking technologies. Analytical cookies used by bck33 are configured to anonymise IP addresses before any data is stored or processed.

You may manage or disable cookies at any time through your browser settings. Please note that disabling strictly necessary cookies may prevent certain core platform functions — such as maintaining your login session — from operating correctly.

8 Data Retention

bck33 retains personal data for the minimum period necessary to fulfil the purposes described in this Policy, and in compliance with applicable legal retention obligations. Our standard retention periods are as follows:

• Active Account Data: Retained for the duration of the account relationship, plus a post-closure retention period of five (5) years to satisfy AML, KYC, and financial record-keeping obligations.
• Transaction Records: Deposit and withdrawal records are retained for a minimum of five (5) years following the date of each transaction, in accordance with anti-money laundering regulations.
• Identity Verification Documents: Retained for five (5) years following account closure or the completion of the relevant verification procedure, whichever is later.
• Customer Support Records: Chat transcripts and email correspondence are retained for three (3) years following the closure of the relevant support case.
• Marketing Consent Records: Retained for the duration of consent plus two (2) years following withdrawal of consent, for audit purposes.
• Analytical and Technical Logs: Server logs, IP address logs, and session data are retained for a maximum of thirteen (13) months, after which they are automatically purged or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or irreversibly anonymised. Anonymised data (which cannot be used to identify any individual) may be retained indefinitely for aggregate statistical and business intelligence purposes.

9 Data Security

bck33 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

• Encryption in Transit: All communication between your browser or device and bck33 servers is encrypted using TLS 1.2 or higher. The bck33.io domain enforces HTTPS across all pages and resources.
• Encryption at Rest: Sensitive data fields stored in bck33 databases — including identity document references, payment account identifiers, and account credentials — are encrypted at rest using AES-256 or equivalent standards.
• Password Security: Player passwords are never stored in plain text. They are hashed using a computationally intensive one-way hashing algorithm (bcrypt) with a unique per-user salt, making them resistant to brute-force and rainbow-table attacks.
• Access Controls: Access to personal data within bck33's internal systems is restricted on a strict need-to-know basis. Staff access is role-based, logged, and reviewed periodically. No single individual has unrestricted access to all player data.
• Infrastructure Security: bck33 servers are hosted in data centres with physical access controls, continuous environmental monitoring, redundant power supplies, and 24/7 security surveillance.
• Vulnerability Management: bck33 conducts regular security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential security weaknesses in the platform.

In the event of a personal data breach that poses a risk to your rights and freedoms, bck33 will notify affected players without undue delay and will take immediate steps to contain, investigate, and remediate the breach.

10 Your Rights

As a bck33 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 14 calendar days of receipt.

• Right of Access: You have the right to request a copy of the personal data bck33 holds about you, together with information about how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Minor account details (such as phone number or email address) can be updated directly from your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that bck33 may be required by law to retain certain data (e.g., transaction records for AML compliance) even following an erasure request.
• Right to Restriction: In certain circumstances, you may request that bck33 restrict the processing of your personal data — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. Upon receipt of such an objection, bck33 will cease all marketing-related processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

bck33 will not charge a fee for reasonable data rights requests. We reserve the right to verify your identity before processing any data rights request to ensure the security of your personal data.

11 Children & Minors

The bck33 platform is strictly intended for adults aged 21 years and above. bck33 does not knowingly collect, store, or process personal data belonging to persons under the age of 21. Age verification is a mandatory step in the bck33 account registration and KYC process.

If bck33 becomes aware that personal data belonging to a person under the age of 21 has been collected — whether through a misrepresentation at registration or any other means — we will take immediate steps to suspend the relevant account, delete the associated personal data, and void any transactions or balances associated with that account.

If you have reason to believe that a minor has registered an account on the bck33 platform, please notify us immediately at [email protected] and we will investigate and act promptly.

12 Third-Party Links

The bck33 platform may contain references to third-party services — such as payment providers (bKash, Nagad, Rocket, Upay) and game providers (Pragmatic Play, Evolution Gaming, etc.) — whose own privacy policies and data handling practices apply independently of this Policy. bck33 is not responsible for the privacy practices, content, or data security of any third-party services that operate outside the bck33 platform environment.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of the bck33 platform, particularly the privacy notices of your chosen mobile financial service provider when making deposits or withdrawals.

13 Updates to This Policy

bck33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made to this Policy, bck33 will notify registered account holders via the email address associated with their account and/or by displaying a prominent notice on the platform.

The updated Policy will be published on this page with a revised effective date. Your continued use of the bck33 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of, and agreement to, the revised terms. We recommend that you review this page periodically to remain informed of how bck33 protects your personal data.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bck33 handles your personal data, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Use "Privacy Policy Query" or "Data Rights Request" as appropriate
• Live Chat: Available 24/7 via the bck33 platform (BST, UTC+6)
• Response Time: bck33 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 14 calendar days.

bck33 takes all privacy-related enquiries seriously. Where you believe your data rights have not been respected, you are encouraged to raise the matter directly with our support team in the first instance so that we can work to resolve your concern promptly and fairly.