Privacy Policy — How tk0k Protects Your Data

1 Data We Collect

tk0k collects personal data in several ways: directly from you when you register an account, make a deposit, contact support, or use the Platform; automatically when you browse and interact with tk0k.net; and from third-party service providers involved in payment processing and identity verification. Below is a comprehensive account of the categories of personal data we collect and the specific data points within each category.

1.1 Registration and Account Data

When you create a tk0k account, we collect the following information:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (required to verify you are 18 years of age or above);
• Email address (used for account communications and verification);
• Mobile phone number (used for SMS OTP authentication and account recovery);
• Residential address (city, district, division within Bangladesh, or international address where applicable);
• Username and encrypted password;
• Account registration date and IP address at time of registration.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we collect:

• Copies of government-issued photo identification — Bangladeshi National ID Card (NID), passport, or birth certificate;
• Proof of address documentation — utility bills, bank statements, or official correspondence issued within the past 3 months;
• Proof of payment method — confirmation of bKash, Nagad, Rocket, Upay, or bank account ownership in the player's name;
• Selfie or liveness check photographs where required for advanced identity verification.

1.3 Financial Transaction Data

For every deposit and withdrawal processed through your tk0k account, we record:

• Transaction amount in Bangladeshi Taka (৳ / BDT);
• Payment method used (e.g., bKash, Nagad, Dutch-Bangla Bank);
• Payment account reference (e.g., bKash mobile number, bank account last four digits — never full account credentials);
• Transaction timestamp and reference number;
• Transaction status (pending, completed, failed, reversed).

1.4 Gaming Activity Data

tk0k records the following data generated by your use of the Platform's games and betting markets:

• Games played, bets placed, stakes, and outcomes;
• Session start and end times;
• Bonus offers claimed and wagering progress;
• Sports betting markets accessed and bet history;
• Responsible gaming tool settings (deposit limits, session alerts, self-exclusion status).

1.5 Technical and Device Data

When you access tk0k.net, our servers and analytics systems automatically collect the following technical data:

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Screen resolution and language settings;
• Pages visited, time spent on pages, and navigation paths through the Platform;
• Referral source (if you arrived via an internal link or promotional banner);
• Error logs and crash reports.

1. 6 Communications Data

If you contact tk0k's customer support team or respond to any Platform communication, we collect and retain:

• The content of live chat transcripts, emails, and support tickets;
• Your contact details as provided in the communication;
• The date, time, and subject matter of each interaction;
• Any attachments or documents submitted as part of a support request.

2 How We Use Your Data

tk0k processes your personal data only where a lawful basis exists for doing so. The primary lawful bases we rely on are: performance of a contract (your account agreement with tk0k), compliance with legal obligations (AML, KYC, and responsible gaming regulations), legitimate interests pursued by tk0k (fraud prevention, Platform security, service improvement), and, in limited cases, your explicit consent. The table below summarises the key purposes for which we use your data and the corresponding lawful basis.

2.1 Marketing Communications

tk0k will send you promotional communications — including bonus offers, seasonal promotions, and game announcements — only where you have provided your explicit consent to receive such communications during registration or subsequently through your account settings. You may withdraw consent at any time by updating your notification preferences in your account settings or by contacting support at [email protected]. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.

2.2 Automated Decision-Making

tk0k uses automated systems for certain decisions, including: detection of suspicious login activity, real-time fraud screening of payment transactions, and identification of patterns consistent with problem gambling behaviour for responsible gaming interventions. Where an automated decision has a significant effect on your account (such as a temporary suspension triggered by fraud detection), you have the right to request human review of that decision by contacting [email protected]. tk0k will respond to such requests within five business days.

3 Data Sharing & Disclosure

tk0k does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for each specific purpose.

3.1 Service Providers and Data Processors

To deliver the tk0k platform, we engage trusted third-party service providers who process data on our behalf. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other banking partners receive the transaction data necessary to process your deposits and withdrawals;
• Identity verification providers: KYC technology partners receive identity documents and registration data to conduct age and identity verification;
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified studios receive the session data necessary to deliver their games to your device;
• IT infrastructure providers: Cloud hosting, content delivery, and security service providers process technical data as part of delivering and securing the Platform.

All third-party data processors are bound by written data processing agreements that restrict their use of your data to the specific purpose for which it was shared and require them to implement appropriate technical and organisational security measures.

3.2 Legal and Regulatory Disclosure

tk0k will disclose personal data to competent authorities, regulators, or law enforcement agencies where required to do so by applicable law, a court order, or a binding regulatory directive. This includes disclosures required under anti-money laundering legislation, financial intelligence reporting obligations, and cooperation with investigations into fraud, match fixing, or other criminal activity.

3.3 Business Transfers

In the event that tk0k's operating entity undergoes a merger, acquisition, restructuring, or sale of substantially all of its assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. We will provide reasonable notice of any such transfer and of any material change in data processing practices that results from it.

4 Cookies & Tracking

tk0k uses cookies and similar tracking technologies on tk0k.net to ensure the Platform functions correctly, to enhance your user experience, and to collect analytics data that helps us improve the Platform. This section explains the types of cookies we use, what they do, and how you can manage your cookie preferences.

4.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your authentication state, and remember your account preferences. Without these cookies, core Platform features cannot operate. These cookies cannot be disabled.
• Performance and Analytics Cookies: These cookies collect anonymised data about how visitors use tk0k.net — which pages are visited most frequently, how long users spend on each page, and where errors occur. This data is used solely to improve the Platform. We use analytics provided by our own infrastructure rather than third-party advertising networks.
• Functional Cookies: These cookies remember choices you make — such as your preferred language, display settings, and responsible gaming tool configurations — so you do not need to re-enter these preferences on each visit.
• Security Cookies: These cookies support our fraud detection and Platform security systems by tracking session integrity, detecting unusual login patterns, and identifying potentially automated or bot-driven access attempts.

4.2 Managing Cookies

You can manage non-essential cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored by websites. Please note that disabling strictly necessary cookies will prevent you from logging in and using the core features of the tk0k Platform. For detailed instructions on managing cookies in your specific browser, consult your browser's help documentation. tk0k does not use third-party advertising cookies or cross-site tracking technologies.

4.3 Local Storage

In addition to cookies, tk0k may use browser local storage to save session-related data and user interface preferences on your device. This data is stored locally and is not transmitted to our servers independently of your normal account interactions. You can clear local storage data through your browser's developer tools or privacy settings.

5 Data Security

tk0k implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The security architecture of the tk0k platform has been designed with data protection as a foundational requirement rather than an afterthought.

5.1 Technical Security Measures

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and tk0k.net is encrypted using industry-standard 256-bit SSL/TLS protocols. The padlock icon in your browser address bar confirms that your connection is secure at all times.
• Password Hashing: Account passwords are never stored in plain text. They are hashed using a modern, salted cryptographic hashing algorithm before storage, meaning that even in the event of a data breach, your password cannot be recovered from stored data.
• Two-Factor Authentication (2FA): tk0k offers SMS OTP-based two-factor authentication for all accounts. We strongly recommend that all players enable 2FA to add an additional layer of protection to their account.
• Access Controls: Access to personal data held by tk0k is restricted on a strict need-to-know basis. Internal systems enforce role-based access controls, and all access to sensitive data is logged and audited.
• Intrusion Detection: Our infrastructure is monitored continuously by automated intrusion detection and prevention systems. Unusual access patterns trigger immediate alerts and automated protective responses.

5.2 Organisational Security Measures

Beyond technical controls, tk0k maintains the following organisational safeguards:

• Regular security training for all staff with access to personal data;
• Strict background verification for employees in roles involving access to player data;
• Incident response procedures to detect, contain, and report data breaches within required timeframes;
• Regular review and audit of data processing activities and third-party processor compliance.

5.3 Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, tk0k will notify affected users without undue delay, providing details of the nature of the breach, the data affected, the likely consequences, and the measures taken to address the breach and mitigate its impact. Notifications will be sent to the email address registered on your tk0k account.

6 Data Retention

tk0k retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal retention obligations, and to resolve disputes or enforce agreements. The retention periods described below reflect the balance between operational necessity, legal compliance, and your privacy interests.

6.1 Active Account Data

While your tk0k account remains active, we retain all account, transaction, and gaming activity data associated with your account. This data is necessary to provide you with continuity of service, maintain accurate financial records, and fulfil our responsible gaming monitoring obligations.

6.2 Post-Closure Retention

Following the closure of your tk0k account — whether at your request, due to inactivity, or as a result of a compliance action — we retain your personal data for a minimum period of five (5) years from the date of account closure. This retention period reflects our obligations under anti-money laundering legislation, which requires financial service providers to retain transaction records and identity verification data for defined minimum periods.

6.3 Shorter Retention Periods

Certain categories of data are subject to shorter retention periods where the purpose for which they were collected is fulfilled more quickly:

• Marketing consent records and promotional communication logs: retained for 2 years from the date of the last interaction;
• Customer support transcripts and communications: retained for 3 years from the date of the interaction;
• Technical and device data (server access logs): retained for 12 months on a rolling basis.

6.4 Anonymisation

Where data is required for analytics or research purposes beyond the periods described above, tk0k will anonymise the data in a manner that makes it impossible to identify any individual from the retained dataset. Anonymised data is not subject to this Privacy Policy, as it no longer constitutes personal data.

7 Your Privacy Rights

tk0k respects your rights over your personal data. The following rights are available to all registered users of the tk0k platform. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and a description of the right you wish to exercise. We will acknowledge your request within 48 hours and respond in full within 30 days.

7.1 Right to Access

You have the right to request a copy of all personal data that tk0k holds about you. Upon receipt of a verified access request, we will provide a structured summary of your data in a commonly used, machine-readable format within 30 days. There is no charge for a first data access request; subsequent requests within a 12-month period may be subject to a reasonable administrative fee.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay. For certain data types — such as your registered name or date of birth — correction requires submission of supporting documentation consistent with our KYC requirements.

7.3 Right to Erasure

You may request that tk0k delete your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other lawful basis for processing; or the data has been unlawfully processed. This right is subject to overriding obligations — tk0k is not able to delete data that it is legally required to retain for anti-money laundering, fraud prevention, or dispute resolution purposes.

7.4 Right to Restrict Processing

You have the right to request that tk0k restrict the processing of your personal data in certain circumstances — for example, while the accuracy of your data is being contested, or while a complaint about the lawfulness of processing is being resolved. During a restriction period, tk0k may store your data but may not process it for any purpose other than storage, except with your consent or for legal claims.

7.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.

7.6 Right to Object

You have the right to object to the processing of your personal data where tk0k relies on legitimate interests as the lawful basis, including profiling based on legitimate interests. tk0k will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims. You may also object at any time to processing for direct marketing purposes, including profiling related to direct marketing.

8 Policy Updates & Contact

8.1 Updates to This Privacy Policy

tk0k reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, Platform features, legal requirements, or regulatory guidance. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Where changes are material, we will notify registered users by email and by placing a prominent notice on tk0k.net prior to the changes taking effect. We encourage you to review this Privacy Policy each time you visit the Platform to stay informed of how your data is being handled.

8.2 Children's Privacy

The tk0k platform is intended exclusively for adults aged 18 and above. We do not knowingly collect personal data from persons under 18 years of age. If we become aware that an account has been registered by a person under 18, the account will be immediately closed, the personal data deleted from our active systems (subject to any legal retention obligations), and any deposits returned where practicable. Parents or guardians who believe a minor has registered on tk0k should contact [email protected] immediately.

8.3 Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or tk0k's data processing practices, please contact our data protection team by email at [email protected]. We are committed to resolving all privacy-related enquiries promptly, fairly, and transparently. If you are unsatisfied with our response to your privacy concern, you have the right to escalate the matter to the data protection authority or supervisory body applicable in your jurisdiction.