ok37 Privacy Policy — Your Data, Your Rights

1 Introduction

ok37 ("ok37", "we", "us", "our") operates the online betting and casino platform accessible at https://ok37.io. We are committed to protecting the privacy and personal data of every individual who accesses or uses our platform, whether as a registered player, a visitor browsing our website, or a person who contacts our support team.

This Privacy Policy ("Policy") sets out in formal, plain English the basis on which any personal data we collect from you — or that you provide to us — will be processed by ok37. Please read this Policy carefully before creating an account or submitting any personal information to us. By registering an ok37 account or by continuing to use the ok37 platform, you acknowledge that you have read, understood, and agreed to the terms of this Policy.

This Policy applies to all data processing activities carried out by ok37 in connection with the ok37 platform, including the website at https://ok37.io, any mobile-optimised web interface, and all customer support communications. It does not apply to third-party websites or services that may be linked to or from our platform — those entities operate under their own privacy policies.

2 Personal Data We Collect

ok37 collects personal data in the following categories. We collect only what is necessary for the purposes described in this Policy.

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify that you meet the 21+ age requirement)
• Nationality and country of residence
• Username chosen at the time of registration
• Gender (where voluntarily provided)

2.2 Contact Data

• Email address
• Mobile phone number registered to your bKash, Nagad, Rocket, or Upay account
• Residential address (district, division, and postcode within Bangladesh — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar)

2.3 Identity Verification (KYC) Data

• Scanned or photographed copies of your National ID Card, Passport, or Driving Licence
• Proof of address documents (utility bills, bank statements dated within 90 days)
• Selfie photographs taken for liveness verification
• Source-of-funds documentation where required for enhanced due diligence

2.4 Financial & Transaction Data

• bKash, Nagad, Rocket, Upay mobile wallet numbers used for BDT deposits and withdrawals
• Bank account details for Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or Sonali Bank transfers
• Full transaction history: deposit amounts (৳), withdrawal amounts (৳), dates, and payment method used
• Wagering history: bets placed, markets selected, odds accepted, and settlement outcomes
• Bonus and promotional credit activity

2.5 Technical & Usage Data

• IP address at time of registration and each subsequent login
• Device type, operating system, and browser version
• Device fingerprint identifier (used to detect multiple-account creation)
• Session timestamps, pages visited, and features accessed within the ok37 platform
• Geolocation data derived from IP address (country and approximate region only; no precise GPS data)
• Referral source (the URL or channel through which you arrived at ok37.io)

2.6 Communications Data

• Support tickets, live chat transcripts, and email correspondence with the ok37 team
• Survey responses and feedback forms completed voluntarily
• Promotional opt-in and opt-out preferences

3 How We Collect Your Data

ok37 collects personal data through the following channels:

• Account Registration: Data you enter directly when creating your ok37 account, including name, email, date of birth, mobile number, and chosen username.
• KYC Verification Submissions: Documents and photographs you upload through the ok37 verification portal in response to a KYC request from our compliance team.
• Deposits and Withdrawals: Financial data is captured automatically when you initiate a BDT transaction through the ok37 cashier, including the mobile wallet number or bank account used.
• Platform Usage: Technical and behavioural data is collected automatically as you navigate the ok37 website through server logs, session tracking, and device fingerprinting systems.
• Cookies and Similar Technologies: As described in Section 7 of this Policy, ok37 uses cookies and similar tracking technologies to improve platform performance and detect suspicious activity.
• Support Communications: Any personal data you include in emails, live chat messages, or support tickets sent to the ok37 team is captured and stored as part of our customer support records.
• Third-Party Verification Providers: In some cases, ok37 may receive identity verification results or fraud-risk scores from third-party KYC service providers to whom we have transmitted your submitted documents for independent verification. This is done solely to fulfil our compliance obligations.

4 Legal Basis for Processing Your Personal Data

ok37 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

5 How We Use Your Personal Data

ok37 uses the personal data it collects for the following specific purposes:

• Account Management: To register your ok37 account, authenticate your identity at login, maintain your account settings, and process account closure requests.
• Transaction Processing: To facilitate BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer channels, and to maintain accurate records of all financial transactions.
• Identity Verification: To verify that you are who you claim to be, that you are aged 21 or above, and that your payment methods are registered in your own name — in fulfilment of our Know Your Customer obligations.
• Fraud and Financial Crime Prevention: To detect, investigate, and prevent unauthorised account access, payment fraud, multiple-account creation, bonus abuse, match-fixing activity, and money laundering through the ok37 platform.
• Responsible Gaming: To monitor your gambling behaviour against responsible gaming indicators, to enforce deposit limits and self-exclusion requests you have activated, and to contact you if your account activity triggers a responsible gaming concern.
• Personalised Platform Experience: To display betting markets, game recommendations, and promotional offers that are relevant to your activity history on ok37, where you have not opted out of personalisation.
• Marketing Communications: To send you promotional emails and platform notifications about ok37 offers, seasonal campaigns (Eid, Pohela Boishakh, BPL season, IPL season, Victory Day), and product updates — only where you have opted in to receive such communications.
• Customer Support: To respond to your support queries, investigate complaints, and maintain a record of communications for quality assurance purposes.
• Legal and Regulatory Compliance: To retain records as required by applicable law, to respond to lawful requests from regulatory or law enforcement authorities, and to enforce the ok37 Terms and Conditions.

6 Data Sharing & Disclosure

ok37 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the specified purpose.

6.1 KYC and Identity Verification Providers

ok37 may share identity documents and verification data with third-party KYC service providers engaged to conduct independent identity verification on our behalf. These providers are contractually bound to process your data solely for verification purposes and to maintain confidentiality.

6.2 Payment Processing Partners

Transaction data is shared with the relevant payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or Sonali Bank) to the extent necessary to process your deposit or withdrawal. These providers operate under their own privacy policies and are independently regulated.

6.3 Game Technology Providers

When you play games supplied by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Hacksaw Gaming, Play'n GO, or Ezugi, your player session data (player ID, bet amounts, game outcomes) is shared with the relevant game provider in real time to enable the game to function. Game providers do not receive your identity documents or payment method details.

6.4 Fraud Prevention and Security Services

ok37 uses third-party fraud detection and cybersecurity services. These services may process your IP address, device fingerprint, and behavioural data to generate fraud-risk scores that inform ok37's account security decisions.

6.5 Legal and Regulatory Disclosure

ok37 may disclose your personal data to law enforcement agencies, financial intelligence authorities, or regulatory bodies where required to do so by applicable law, a lawful court order, or to protect the legal rights and interests of ok37 or third parties. ok37 will not disclose data beyond what is strictly required by the legal obligation in question.

6.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of ok37's business, player personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material change to this Privacy Policy that results from it, prior to your data being subject to a different privacy policy.

7 Cookies & Tracking Technologies

ok37 uses cookies and similar technologies (including session tokens, local storage objects, and device fingerprinting scripts) to operate the platform, maintain your login session, detect fraud, and analyse aggregate platform usage. The types of cookies used by ok37 are described below.

ok37 does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in to your ok37 account.

8 Data Retention

ok37 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law. The table below sets out the primary retention periods applied by ok37.

When a retention period expires, ok37 will securely delete or irreversibly anonymise the relevant personal data. Anonymised, aggregated data that cannot be linked back to any individual may be retained indefinitely for statistical and analytical purposes.

9 Data Security

ok37 implements a multi-layered security framework designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures in place include:

• Transport Encryption: All data transmitted between your browser and the ok37 platform is encrypted using TLS 1.3 / 256-bit SSL. This applies to all login sessions, deposits, withdrawals, and support communications.
• Data-at-Rest Encryption: Player data stored in ok37's databases is encrypted using AES-256 encryption. Encryption keys are managed using a hardware security module (HSM) and are rotated on a scheduled basis.
• Access Controls: Access to player personal data within ok37's internal systems is restricted to authorised personnel on a strict need-to-know basis. All staff access is logged and subject to regular audit.
• Intrusion Detection: ok37 operates real-time intrusion detection and prevention systems (IDS/IPS) that monitor platform infrastructure for anomalous activity, attempted breaches, and distributed denial-of-service (DDoS) attacks.
• Vulnerability Management: ok37 conducts regular security assessments, penetration tests, and code reviews to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, ok37 will notify affected players without undue delay and will take all reasonable steps to contain the breach and mitigate its impact.

10 Your Data Subject Rights

As a player whose personal data is processed by ok37, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and your registered email address. ok37 will respond to all verified data rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data that ok37 holds about you, together with information about how it is being used.
• Right to Rectification: If any personal data ok37 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. This right is subject to ok37's legal data retention obligations described in Section 8 — we may be unable to delete data that we are legally required to retain.
• Right to Restrict Processing: You may request that ok37 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where ok37 relies on legitimate interests as its legal basis. ok37 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11 Children & Minors

The ok37 platform is strictly intended for individuals aged 21 years and above. ok37 does not knowingly collect, store, or process personal data belonging to individuals under the age of 21. If you are a parent or guardian and you believe that a minor has registered an ok37 account or has submitted personal data to ok37 without your knowledge, please contact us immediately at [email protected]. We will take prompt steps to verify the reported situation, suspend the account in question, and delete any personal data collected from or relating to the minor.

ok37 employs age verification as part of the KYC process specifically to prevent minors from accessing the platform. Any account found to belong to an individual under the age of 21 will be closed without delay.

12 Third-Party Links

The ok37 website may contain references to third-party services — for example, the payment providers (bKash, Nagad, Rocket, Upay) through which you make BDT deposits and withdrawals, or the game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) whose games are hosted on the ok37 platform. While ok37 selects its technology and payment partners with care, ok37 is not responsible for the privacy practices of these third parties.

When you transact through a mobile wallet provider or interact with a game provider's software, you are also subject to that provider's own privacy policy. ok37 encourages you to review the privacy policies of any third-party service you use in connection with your ok37 account. ok37 accepts no liability for any loss or damage arising from your reliance on a third party's privacy practices .

13 Amendments to This Privacy Policy

ok37 reserves the right to amend, update, or replace this Privacy Policy at any time. When we make a material change to this Policy — meaning a change that meaningfully affects how we collect, use, or share your personal data — we will notify you by email to the address registered on your ok37 account at least 14 days before the change takes effect. For minor or administrative changes that do not materially affect your rights, we may update the Policy without individual notification, but the revised version will always be published at https://ok37.io/privacy-policy with an updated "Last Updated" date at the top of the document.

Your continued use of the ok37 platform after any amendment to this Policy constitutes your acceptance of the revised Policy. If you do not agree with the changes, you should close your ok37 account and cease using the platform before the amended Policy takes effect. To close your account, contact [email protected] with the subject line "Account Closure Request".

ok37 recommends that you review this Privacy Policy periodically — at a minimum, whenever you receive a notification of a material change — to stay informed about how your personal data is being handled. The version number and effective date displayed at the top of this document will always reflect the most current published version.

14 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about the way in which ok37 processes your personal data, please contact our Data Protection team using the details below. All privacy-related correspondence must be submitted in English.

Email: [email protected] (subject line: "Privacy Enquiry" or "Data Rights Request")

Response Time: ok37 aims to acknowledge all privacy-related enquiries within 2 business days (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days of receipt. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day period expires.

Escalation: If you are not satisfied with ok37's response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. ok37 will cooperate fully with any such investigation.