bdka1 Privacy
Policy

bdka1 collects personal data from you through several channels: directly from you during account registration and KYC verification, automatically through your use of the platform, and in limited circumstances from third-party sources such as payment processors. The categories of data we collect are described below.

1.1 Registration Data

When you create a bdka1 account, we collect the following information that you provide voluntarily:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (to verify that you meet the 18+ age requirement)
• Residential address in Bangladesh (division, district, city or town)
• Mobile phone number registered in your name
• Email address
• Chosen username and encrypted account password

1.2 Identity Verification (KYC) Data

As part of our mandatory Know Your Customer (KYC) process, we collect copies of identity documents you submit, which may include:

• National Identity Card (NID) or Smart NID
• Valid Bangladeshi passport (biographical data page)
• Birth certificate (where submitted alongside a supporting address document)
• Utility bill or bank statement as proof of current residential address
• Selfie photograph or video verification (where required for enhanced due diligence)

KYC documents are retained in encrypted storage and are accessible only to our compliance team for the purpose of regulatory verification. They are not shared with game providers or marketing partners.

1.3 Financial Transaction Data

When you make deposits or request withdrawals, bdka1 collects transactional data including the payment method used (e.g., bKash account number, Nagad wallet reference, bank account details), transaction amounts in BDT, timestamps, and transaction reference numbers. We do not store full card numbers — card transactions are tokenised through our payment processing partners.

1.4 Technical and Usage Data

When you access the bdka1 platform, our servers automatically log certain technical information including your IP address, device type and operating system, browser type and version, pages visited and session duration, game play history (game titles, bet amounts, outcomes), and time-zone information. This data is used for platform security, fraud prevention, and improving the user experience.

1.5 Communications Data

If you contact our customer support team — whether via live chat, email to [email protected], or any other channel — we retain records of that correspondence, including the content of messages, the date and time of contact, and the resolution applied. These records help us maintain service quality and resolve disputes accurately.

bdka1 does not sell, rent, or trade your personal data. We share data only with a limited set of third parties where necessary to operate the platform, comply with legal requirements, or protect the safety of our player community. All third-party service providers engaged by bdka1 are contractually bound to handle your data in a manner consistent with this Privacy Policy.

3.1 Payment Processing Partners

To process deposits and withdrawals, bdka1 shares the minimum necessary financial data with our payment partners, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Visa/Mastercard processing networks. These partners receive only the transactional data required to execute the specific payment instruction and are prohibited from using that data for any other purpose.

3.2 Game Studio Providers

When you launch a game by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, or another partner studio, a technical session token is passed to the studio's game server to authenticate your session. This token does not contain your name, NID number, or payment details — it is an anonymised session reference. Game studios do not have access to your bdka1 registration profile.

3.3 KYC and Identity Verification Services

bdka1 may engage specialist third-party KYC verification platforms to assist in validating the authenticity of identity documents submitted by players. These providers operate under strict data processing agreements and handle document data solely for the purpose of identity verification on behalf of bdka1.

3.4 Legal and Regulatory Disclosure

bdka1 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where we are legally required to do so, where disclosure is necessary to prevent or investigate fraud or financial crime, or where we are ordered to do so by a court of competent jurisdiction. We will notify you of such disclosure where we are legally permitted to do so.

3.5 Business Transfers

In the event that bdka1 undergoes a merger, acquisition, or sale of all or part of its assets, player data may be transferred to the acquiring entity as part of that transaction. We will notify players of any such change in data controller via a prominent notice on the bdka1 platform prior to the transfer taking effect, and we will ensure that the acquiring entity is bound by terms consistent with this Privacy Policy.

The security of your personal data is a priority for bdka1. We implement a combination of technical, organisational, and procedural controls to protect your information against unauthorised access, accidental loss, destruction, or disclosure.

5.1 Technical Security Measures

• 256-bit SSL/TLS encryption on all data in transit between your browser and our servers.
• AES-256 encryption at rest for all personally identifiable data and KYC documents stored in our databases.
• Multi-factor authentication (MFA) required for all internal staff accounts with access to production player data.
• Firewalls and intrusion detection systems monitoring our network perimeter around the clock.
• Regular penetration testing by independent third-party security specialists to identify and remediate vulnerabilities.

5.2 Organisational Security Measures

Access to personal data within bdka1 is governed by a strict principle of least privilege — staff are granted access only to the data categories and tools required to perform their specific job function. All staff with data access undergo mandatory data protection training at onboarding and annually thereafter. Access logs are reviewed regularly by our security and compliance team.

5.3 Data Breach Response

In the event of a confirmed personal data breach that is likely to result in a risk to your rights or freedoms, bdka1 will notify affected players without undue delay — and in any event within 72 hours of becoming aware of the breach — via the registered email address on your account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures bdka1 has taken or proposes to take to address the breach.

bdka1 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following sets out our standard retention periods by data category.

7.1 Deletion After Retention Period

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Anonymised data — from which you cannot be identified — may be retained indefinitely for aggregated statistical analysis. Deletion is irreversible; once your data has been deleted following the expiry of the retention period, it cannot be recovered.

7.2 Inactive Accounts

Accounts that have been inactive for 12 consecutive months (no login, no transaction) are flagged as dormant. bdka1 will notify you by email before initiating any data deletion process on a dormant account. You may reactivate your account at any time by logging in and completing a re-verification step. Dormant accounts with a positive BDT balance will not have their funds deleted — funds remain available for withdrawal for the full retention period applicable to financial transaction records.