Privacy Policy — How 38ok Protects Your Data

Introduction

38ok ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who register for and use the 38ok online betting and gaming platform accessible at https://38ok.io. This Privacy Policy sets out in clear, formal English the basis on which any personal data we collect from you — or that you provide to us — will be processed by 38ok.

This Privacy Policy applies to all services offered through the 38ok platform, including cricket betting, live casino, slots, instant-win games, promotional activities, and customer support interactions. It applies to all players located in Bangladesh and to all data processing activities carried out in connection with the delivery of those services.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement governing your relationship with 38ok. In the event of any conflict between this Privacy Policy and any other document, this Privacy Policy shall take precedence with respect to data protection matters.

38ok operates a principle of data minimisation. We collect only the personal information that is genuinely necessary to operate your account, verify your identity in accordance with responsible gaming and anti-money laundering requirements, process your deposits and withdrawals in Bangladeshi Taka (BDT), and deliver our services to players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

Information We Collect

2.1 Information You Provide Directly

When you register an account on 38ok, use our services, or contact our support team, you may provide us with the following categories of personal data:

• Identity data: Full legal name, date of birth, gender, nationality
• Contact data: Email address, mobile phone number, residential address (including city, district, and division within Bangladesh)
• Account data: Username, password (stored in hashed, non-reversible form), account preferences, and communication preferences
• Verification documents: National Identification Card (NID), passport copy, or other government-issued identity document submitted during KYC verification
• Payment data: Mobile financial service account identifiers (bKash, Nagad, Rocket, or Upay account numbers registered in your name). We do not store full payment credentials — only account identifiers needed to process transactions.
• Support communications: The content of any messages, emails, or live chat transcripts you submit to our support team

2.2 Information Collected Automatically

When you access and use the 38ok platform, certain technical data is automatically collected by our systems for security, fraud prevention, and platform optimisation purposes:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and language settings
• Usage data: Pages visited, features accessed, games played, bet history, session duration, click patterns, and navigation paths within the platform
• Transaction data: Deposit amounts, withdrawal requests, bonus claims, wagering activity, and account balance history
• Log data: Server logs recording login timestamps, actions performed on your account, and security events such as failed login attempts

2.3 Information From Third Parties

In limited circumstances, 38ok may receive personal data about you from third-party sources. This may include:

• Payment verification data from bKash, Nagad, Rocket, or Upay confirming that a transaction was successfully initiated from your registered mobile financial service account
• Identity verification responses from third-party KYC service providers engaged by 38ok to validate NID or passport documents
• Fraud prevention data from industry-standard risk and compliance screening tools

In all cases, third-party data sources are contractually bound to share only the minimum data necessary for the specific purpose and are required to handle that data in accordance with applicable data protection standards.

How We Use Your Data

38ok uses personal data collected from Bangladesh players for the following specific, lawful purposes:

3.1 Account Registration and Management

Your identity and contact data is used to create and maintain your 38ok player account, verify that you meet the minimum age requirement of 21 years, authenticate your identity when you log in, and manage your account settings and communication preferences.

3.2 Payment Processing

Your payment data and identity information are used to process deposits and withdrawals in BDT via bKash, Nagad, Rocket, and Upay; to verify that the payment method is registered in your own name; and to maintain accurate financial records of all transactions associated with your account.

3.3 Identity Verification (KYC)

We use identity and document data to comply with Know Your Customer (KYC) requirements. KYC verification is required before processing withdrawals and may be required at other points during the account lifecycle where 38ok's compliance team deems it appropriate.

3.4 Service Delivery and Platform Operation

Technical and usage data is used to operate, maintain, and improve the 38ok platform; to personalise your experience; to ensure that games and betting markets function correctly; to detect and resolve technical errors; and to manage responsible gaming features associated with your account.

3.5 Fraud Prevention and Security

38ok uses technical data, usage data, and identity data to detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, match fixing, and other forms of prohibited conduct as defined in our Terms & Conditions. This includes automated risk-scoring systems and human compliance review.

3.6 Customer Support

Support communication data is used to respond to your queries, resolve disputes, investigate complaints, and improve our support quality. Support transcripts may be retained for a period of up to 36 months for quality assurance and regulatory compliance purposes.

3.7 Marketing Communications (Opt-in Only)

Where you have explicitly opted in to receive marketing communications from 38ok, we may use your email address or mobile number to send you information about promotions, bonuses, new games, and seasonal offers relevant to Bangladesh players. You may withdraw your consent to marketing communications at any time by contacting [email protected] or by adjusting your account communication preferences. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

3.8 Legal and Regulatory Compliance

38ok may process and disclose personal data where required to comply with applicable legal obligations, respond to lawful requests from regulatory bodies or law enforcement authorities, enforce our Terms & Conditions, or protect the legal rights and interests of 38ok and its players.

Legal Basis for Processing

38ok processes personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing that is required to perform the contract between you and 38ok — including account registration, identity verification, payment processing, and game delivery — is carried out on the basis of contractual necessity. Without this processing, 38ok cannot provide its services to you.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and internal analytics is carried out on the basis of 38ok's legitimate interests in operating a safe and fair platform. 38ok has assessed that these interests do not override your fundamental privacy rights.
• Legal obligation: Processing required to comply with applicable laws, respond to regulatory enquiries, or fulfil anti-money laundering obligations is carried out on the basis of legal obligation.
• Consent: Processing for optional marketing communications is carried out solely on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting other processing activities.

Data Sharing & Disclosure

5.1 We Do Not Sell Your Data

38ok does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party. Your personal data is not used for advertising networks or data broker services.

5.2 Service Providers

38ok engages a limited number of trusted third-party service providers who process personal data on our behalf in order to support the delivery of our platform services. These service providers are contractually bound to process data only on 38ok's documented instructions, to implement appropriate security measures, and not to use your data for their own independent purposes. Current categories of service providers include:

• KYC and identity verification service providers
• Payment processing infrastructure providers
• Cloud hosting and data storage infrastructure providers
• Live casino game technology providers (Evolution Gaming, Ezugi, Pragmatic Play Live)
• RNG-certified slot and instant-game providers (Pragmatic Play, NetEnt, Microgaming, Spribe)
• Fraud detection and risk management tool providers
• Customer support platform providers

5.3 Legal and Regulatory Disclosure

38ok may disclose personal data to law enforcement agencies, regulatory authorities, or other government bodies where required to do so by applicable law or by a valid legal order. 38ok will, where lawfully permitted to do so, notify you of any such disclosure request.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of 38ok's business assets, personal data held by 38ok may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy practices of the acquiring entity prior to your data being transferred, and you will have the option to request deletion of your account before the transfer takes effect.

Cookies & Tracking Technologies

6.1 What Cookies We Use

38ok uses a minimal set of cookies and similar tracking technologies that are necessary to operate the platform securely and to preserve your session preferences. We do not deploy advertising cookies, behavioural profiling trackers, or third-party social media pixels on the 38ok platform.

6.2 Managing Cookies

You can control and delete cookies through your browser settings at any time. Please note that disabling essential session or authentication cookies will prevent you from logging in to your 38ok account and using the platform's services. Preference and security cookies can be cleared without affecting your ability to access the platform, although some display settings may reset to defaults.

Data Security

38ok implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the 38ok platform is encrypted in transit using industry-standard 256-bit SSL/TLS protocols
• Password hashing: Account passwords are stored using a one-way cryptographic hashing algorithm. Plaintext passwords are never stored or transmitted by 38ok systems
• Access controls: Access to personal data within 38ok's internal systems is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls and audit logging
• Data encryption at rest: Sensitive data fields including identity documents and payment identifiers are encrypted at rest within our secure data storage infrastructure
• Intrusion detection: 38ok operates continuous automated monitoring for suspicious access patterns, attempted intrusions, and anomalous data access events
• Regular security audits: Our platform and infrastructure undergoes periodic independent security assessments to identify and remediate vulnerabilities

While 38ok employs industry-leading security practices, no online platform can guarantee absolute security against all threats. Players are strongly encouraged to use a strong, unique password for their 38ok account, to enable any available two-factor authentication features, and to contact [email protected] immediately if they suspect any unauthorised access to their account.

Data Retention

38ok retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account data: Retained for the duration of your active account relationship with 38ok, and for a period of up to 5 years following account closure, to comply with anti-money laundering record-keeping requirements
• KYC and identity documents: Retained for up to 5 years following the completion of the verification process or account closure (whichever is later), in accordance with applicable compliance obligations
• Transaction records: Retained for up to 7 years from the date of each transaction to satisfy financial record-keeping requirements
• Support communications: Retained for up to 36 months from the date of the interaction for quality assurance, dispute resolution, and compliance purposes
• Technical and usage data: Retained for up to 24 months from collection for platform analytics, fraud prevention, and security monitoring purposes
• Marketing consent records: Retained for the duration of your consent and for up to 3 years following withdrawal of consent, to maintain a record of consent transactions

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised so that it can no longer be associated with any identifiable individual. Players may request early deletion of their data subject to applicable legal retention obligations — see Section 9 for details.

Your Privacy Rights

As a registered player on 38ok, you hold the following rights in respect of your personal data. These rights may be exercised by submitting a written request to [email protected]. 38ok will acknowledge your request within 5 business days and provide a substantive response within 30 days of receipt.

9.1 Right of Access

You have the right to request a copy of the personal data that 38ok holds about you. Upon a valid access request, 38ok will provide you with a summary of the data categories held, the purposes for which they are processed, and, where feasible, the specific data itself in a structured, readable format.

9.2 Right to Rectification

You have the right to request the correction of inaccurate or incomplete personal data held about you. Where the data in question forms part of your registered account details, you may also update certain fields directly through your account settings.

9.3 Right to Erasure ("Right to be Forgotten")

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where you believe the data has been processed unlawfully. 38ok will honour valid erasure requests subject to any overriding legal obligation to retain the data (such as financial record-keeping requirements). Where full deletion is not possible due to legal obligations, 38ok will restrict the processing of your data to the minimum required by law.

9.4 Right to Restriction of Processing

You have the right to request that 38ok restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while a complaint is under investigation.

9.5 Right to Data Portability

Where processing is carried out on the basis of your consent or contractual necessity, and is performed by automated means, you have the right to request a copy of your personal data in a structured, commonly used, machine-readable format.

9.6 Right to Object

You have the right to object to the processing of your personal data where 38ok relies on legitimate interests as the legal basis for processing. 38ok will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

9.7 Right to Withdraw Consent

Where 38ok processes your personal data on the basis of your consent (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Children's Privacy

The 38ok platform is strictly restricted to individuals aged 21 years or older. 38ok does not knowingly collect, process, or retain any personal data from individuals under the age of 21. All registration processes include an age declaration requirement, and accounts found to belong to individuals under 21 will be immediately closed and all associated data deleted.

If you have reason to believe that a person under the age of 21 has registered an account or provided personal data to 38ok, please notify our support team immediately at [email protected]. We will investigate and, where confirmed, take immediate steps to delete the relevant account and all associated personal data.

Third-Party Services

The 38ok platform integrates third-party game content and technology from licensed providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers operate their own game environments within the 38ok platform and may collect limited technical data (such as session identifiers and game event logs) necessary to deliver their game content and calculate outcomes.

38ok's Privacy Policy does not extend to the independent data processing activities of third-party game providers. Players are encouraged to review the privacy policies of individual game providers where available. 38ok selects game providers who maintain appropriate data protection standards and who are contractually obligated to handle any player data in compliance with applicable requirements.

38ok's platform does not contain links to external third-party websites beyond the services necessary to deliver the platform's functions. This Privacy Policy applies exclusively to the 38ok platform at https://38ok.io and does not govern the data practices of any external website.

Amendments to This Policy

38ok reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes to the services we offer. When material changes are made to this policy, 38ok will notify registered players by:

• Displaying a prominent notice on the 38ok platform upon your next login
• Sending an email notification to your registered email address

The effective date of any revision will be clearly stated at the top of the updated policy document. Continued use of the 38ok platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy.

38ok encourages all registered players to review this Privacy Policy periodically. The most current version of this policy is always accessible on this page at https://38ok.io/privacy-policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by 38ok, please contact our dedicated support team. We are committed to resolving all privacy-related enquiries promptly and transparently.

Email: [email protected] (plain text — not a clickable link)

Support Hours: 24 hours a day, 7 days a week — English support in Bangladesh Standard Time (BST, UTC+6)

Coverage: Serving players across all divisions of Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

We aim to acknowledge all privacy enquiries within 5 business days and to provide a full substantive response within 30 calendar days of receipt. Where a request is particularly complex or where a high volume of requests is being processed, we will notify you of any extension to this timeline within the initial 5-day acknowledgement.