0ktk Privacy Policy — How We Handle Your Personal Data

1 Introduction

0ktk ("0ktk", "we", "us", "our") operates the online sports betting and live casino platform at https://0ktk.io (the "Platform"). In the course of providing our services to registered players and visitors in Bangladesh, we collect and process certain personal information. This Privacy Policy ("Policy") sets out a transparent and complete account of what data we collect, why we collect it, how we use it, who we share it with, how long we retain it, and what rights you have over your own data.

By accessing the Platform, completing registration, or using any feature of the 0ktk service, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. This Policy forms part of the broader agreement between you and 0ktk, together with the Terms & Conditions, which you are encouraged to read alongside this document.

0ktk is committed to handling all personal data with the care and discretion that our players expect and deserve. We collect only the data that is necessary to deliver our services, verify player identity, process payments, and comply with our responsible gaming obligations. We do not sell personal data to unaffiliated third parties for their own commercial purposes.

2 Data Controller

For the purposes of this Privacy Policy, the data controller responsible for the collection and processing of your personal information is 0ktk, the operator of the Platform at https://0ktk.io. The data controller determines the purposes and means by which personal data is processed. All data protection enquiries, rights requests, and complaints should be directed to the 0ktk data protection contact at:

• Email: [email protected] (plain text — this address is not a clickable link)
• Platform: https://0ktk.io
• Response time: Within 30 calendar days of receiving a verified data rights request

3 Personal Data We Collect

The categories of personal data that 0ktk collects and processes about you include the following:

3.1 Identity and Registration Data

• Full legal name (as it appears on your national identity document or passport);
• Date of birth (used for mandatory age verification — players must be 21 or older) ;
• Gender (where voluntarily provided during registration);
• Username and account password (stored in encrypted form);
• National Identity Card (NID) number or passport number (collected during KYC verification).

3.2 Contact Data

• Email address;
• Mobile phone number (used for account verification, two-factor authentication, and support communications);
• Residential address including district, division, and postal code (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).

3.3 Financial and Payment Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method references;
• bKash, Nagad, Rocket, or Upay mobile account identifiers associated with your registered name;
• Bank account details where bank transfer methods (Dutch-Bangla Bank, City Bank, BRAC Bank, etc.) are used;
• Visa or Mastercard partial card details where card payments are processed through our payment service provider.

0ktk does not store full card numbers. Card payment data is handled by PCI-DSS compliant third-party payment processors who are contractually bound to treat such data with the highest level of security.

3.4 KYC Verification Documents

• Copies of national identity card, passport, or other government-issued identity documents;
• Proof of address documentation (utility bill, bank statement, or government correspondence);
• Selfie photographs submitted for identity matching purposes, where requested.

3.5 Transactional and Gaming Data

• Sports betting history including markets, stake amounts, odds, and settlement outcomes;
• Casino game session records including game titles, wager amounts, win/loss outcomes, and session durations;
• Bonus claim and wagering requirement completion records;
• Responsible gaming tool usage records (deposit limits set, cool-off periods activated, self-exclusion requests).

3.6 Technical and Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, browser type, and version;
• Session timestamps, login history, and session duration;
• Cookie identifiers and similar tracking technology data (see Section 10).

4 How Personal Data Is Collected

0ktk collects personal data through the following channels and mechanisms:

• Directly from you: when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, or update your account profile;
• Automatically through the Platform: via cookies, server logs, and analytics tools that record your browsing behaviour, login activity, game sessions, and device characteristics as you interact with the Platform;
• From third-party payment providers: transaction confirmation data and payment status updates received from bKash, Nagad, Rocket, Upay, and card payment processors;
• From identity verification services: confirmation results from KYC and document verification partners used to authenticate identity documents submitted during account verification;
• From responsible gaming databases: self-exclusion status data from responsible gaming registries, where applicable, to prevent excluded individuals from opening or reactivating accounts.

5 Purpose of Processing

The following table sets out the primary purposes for which 0ktk processes your personal data:

6 Legal Basis for Processing

0ktk processes your personal data on the following legal bases, depending on the purpose of processing:

• Contractual necessity: Processing that is necessary to perform the agreement between you and 0ktk — including account registration, payment processing, game delivery, and KYC verification — is carried out on the basis that it is required to fulfil our contractual obligations to you;
• Legitimate interests: Processing for fraud detection, platform security, AML compliance monitoring, responsible gaming enforcement, and internal analytics is carried out on the basis of 0ktk's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms;
• Legal obligation: Where processing is required to comply with applicable laws and regulations, including anti-money laundering requirements and age verification obligations, we process data on the basis of legal compliance;
• Consent: Where we send you marketing communications about promotions, bonuses (such as seasonal offers tied to BPL, IPL, or Eid), and new Platform features, we do so on the basis of your consent. You may withdraw this consent at any time by contacting [email protected] or by updating your marketing preferences within your account settings.

7 Data Sharing and Disclosure

0ktk does not sell, rent, or trade your personal data to unaffiliated third parties for their own independent marketing or commercial purposes. We share personal data only in the following limited and controlled circumstances:

7.1 Payment Service Providers

To process your deposits and withdrawals, we share necessary transaction data with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card processing networks. These providers receive only the data required to process the specific transaction and are bound by their own strict data security obligations.

7.2 Identity Verification Partners

KYC documents submitted during account verification may be shared with accredited third-party identity verification services engaged by 0ktk to authenticate identity documents and cross-reference them against applicable databases. Such providers process data solely on 0ktk's instructions and may not use it for any independent purpose.

7.3 Game Content Providers

Third-party game providers — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi — may receive technical session data (such as player session tokens) necessary to deliver their respective game content within the Platform. These providers do not receive your full identity or payment data.

7.4 Legal and Regulatory Disclosure

0ktk may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where we are legally required to do so, where disclosure is necessary to protect 0ktk's legal rights, or where we have a good-faith belief that disclosure is necessary to prevent or investigate fraud, money laundering, or other criminal activity.

7.5 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of 0ktk's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via your registered email address in advance of any such transfer and will ensure that the receiving entity is bound by data protection obligations at least as protective as those set out in this Policy.

8 Data Retention

0ktk retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to maintain an active account relationship with you, and to comply with our legal and regulatory obligations. The following general retention principles apply:

• Active accounts: All personal data associated with an active 0ktk account is retained for the duration of the account relationship;
• Closed accounts: Following account closure, we retain core identity and transactional records for a minimum of five (5) years to comply with anti-money laundering regulations and financial record-keeping requirements;
• KYC documents: Identity verification documents are retained for a minimum of five (5) years following account closure or the date of the last verified transaction, whichever is later;
• Responsible gaming records: Self-exclusion and responsible gaming tool activation records are retained for the duration of the exclusion period plus five (5) years to prevent re-registration during an active exclusion;
• Marketing preferences: Records of your marketing consent or opt-out are retained indefinitely to respect your preferences and to demonstrate compliance;
• Technical/log data: Server logs and technical session data are retained for up to 12 months unless a longer retention period is required for fraud investigation or legal proceedings.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures.

9 Data Security

0ktk implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security practices include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the 0ktk Platform;
• Encryption at rest for sensitive personal data fields including identity document images, financial records, and account credentials stored in our databases;
• Hashed and salted password storage — your account password is never stored in plaintext form;
• Two-factor authentication (2FA) available to all players to add a second layer of protection to account login;
• Access controls ensuring that personal data is accessible only to 0ktk staff members and authorised partners who have a genuine operational need;
• Regular security audits and vulnerability assessments conducted by internal and external security specialists;
• Incident response procedures enabling 0ktk to detect, assess, and respond to data security incidents promptly.

10 Cookies and Tracking Technologies

0ktk uses cookies and similar tracking technologies to enhance your experience on the Platform, to remember your preferences, to keep you securely logged in during your session, and to collect analytics data that helps us improve the Platform's performance and usability.

10.1 Types of Cookies Used

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without affecting core Platform functionality;
• Functional cookies: Remember your preferences such as language settings, regional preferences, and last-used payment methods to streamline your experience;
• Analytics cookies: Collect anonymised or aggregated data about how users navigate the Platform — such as pages visited, time spent, and navigation paths — to help 0ktk identify usability improvements. No personally identifiable information is included in analytics reports;
• Marketing/preference cookies: Where you have provided consent, these cookies enable 0ktk to personalise promotional content and bonus offers based on your activity preferences on the Platform. They do not track your activity on third-party websites.

10.2 Cookie Management

You may control cookie preferences through your browser settings. Most modern browsers allow you to block, delete, or receive alerts about cookies. Please note that disabling strictly necessary cookies may prevent you from using certain features of the Platform, including maintaining a secure login session. Blocking analytics or marketing cookies does not affect your ability to use the core betting and casino features of the Platform.

11 Your Data Rights

As a player on the 0ktk Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with a clear description of your request. We will respond within 30 calendar days of receiving a verified request.

• Right of access: You have the right to request a copy of the personal data that 0ktk holds about you, together with information about how it is being used;
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update basic profile information directly within your account settings;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (see Section 8). We cannot erase data that we are legally required to retain;
• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data and we are verifying it;
• Right to data portability: You have the right to receive the personal data you have provided to 0ktk in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another controller where technically feasible;
• Right to object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You may also object at any time to the use of your data for direct marketing purposes;
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

12 Minors and Age Restriction

The 0ktk Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21. If you are a parent or guardian and you believe that a minor in your care has registered an account or submitted personal data to 0ktk without your consent, please contact us immediately at [email protected]. Upon verification of the report, we will promptly close the account, delete the associated personal data, and reverse any transactions where technically and legally possible.

0ktk employs mandatory age verification as part of the KYC process to prevent underage access. Any account found to belong to a person under the age of 21 will be permanently closed and the matter may be escalated to the relevant authorities where required.

13 Marketing Communications

Where you have provided consent, 0ktk may send you promotional communications via email or SMS relating to new games, sports betting markets, bonus offers, and seasonal promotions. These may include offers tied to BPL (Bangladesh Premier League), IPL, T20 World Cup, Eid, Pohela Boishakh, Victory Day (December 16), Independence Day (March 26), and other events relevant to our Bangladeshi player base.

You may opt out of receiving marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email;
• Updating your communication preferences in your 0ktk account settings;
• Sending a written opt-out request to [email protected].

Opting out of marketing communications does not affect your ability to receive essential transactional communications such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These operational messages are sent on the basis of contractual necessity and cannot be disabled while your account remains active.

14 Changes to This Privacy Policy

0ktk reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. Where a material change is made to this Policy, we will provide advance notice via email to your registered address or via a prominent on-Platform notification before the change takes effect. The "Last Revised" date at the top of this document will be updated accordingly.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept a material change to this Policy, you should cease using the Platform and request account closure before the effective date of the revision.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by 0ktk, please contact our data protection team using the details below. All communications must be in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject line: Include "Privacy Request" or "Data Rights Request" for faster routing
• Response time: Within 30 calendar days of receiving a verified request
• Operating hours: Bangladesh Standard Time (BST, UTC+6), Monday to Saturday

We take all privacy-related enquiries seriously and will handle your request with care and professionalism. Where a complaint cannot be resolved through our internal process, you may have the right to lodge a complaint with the relevant data protection authority applicable to your jurisdiction.