Privacy Policy — How 33pok Protects Your Data

33pok collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the site, and from third-party service providers where necessary to verify your identity or process payments. The categories of data we collect are described in detail below.

1.1 Registration & Account Data

When you create a 33p ok account, we collect the following personal data:

• Full legal name (as it appears on your government-issued identification document)
• Date of birth (used to verify you meet the 18+ age requirement)
• Residential address, including city, district, and postcode within Bangladesh
• Email address (used for account communications and security alerts)
• Mobile phone number registered in Bangladesh
• Username and encrypted password credentials
• Preferred currency (Bangladeshi Taka — ৳)

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) obligations and to protect the platform against fraud and money laundering, we may collect and store copies of the following documents:

• Government-issued photo identification — Bangladesh National Identity Card (NID) or valid passport
• Proof of residential address — utility bill or bank statement dated within the last three months
• Proof of payment method ownership — screenshot or confirmation from bKash, Nagad, Rocket, Upay, or your bank account showing your name and account number
• A selfie or live photograph in certain high-risk verification scenarios, solely for identity matching purposes

1.3 Financial Transaction Data

We record details of all deposits, withdrawals, and wagers made on your account. This includes transaction amounts in Bangladeshi Taka (৳), timestamps, payment method identifiers (such as your registered bKash or Nagad mobile number, or the last four digits of a card), and transaction reference numbers. Full payment card numbers are never stored on 33pok servers — card transactions are processed entirely within the secure environment of our payment processor partners.

1.4 Technical & Usage Data

When you access the 33pok platform, our servers automatically record certain technical data, including:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and navigation path through the platform
• Game sessions initiated, wagers placed, and game outcomes (for audit and dispute resolution purposes)
• Referring website or search query that brought you to the platform
• Session timestamps and duration

This technical data is used to maintain platform security, detect fraud, resolve disputes, and improve the overall user experience for players in Bangladesh and other served markets.

1.5 Communications Data

If you contact our support team at [email protected], submit a complaint, or engage with us through any other written channel, we retain a record of that communication, including your name, contact details, the content of the correspondence, and the outcome. These records are kept for dispute resolution, quality assurance, and legal compliance purposes.

33pok does not sell, rent, or trade your personal data. We share data with third parties only where strictly necessary to operate the platform, comply with legal obligations, or protect against fraud. All third-party partners who process data on our behalf are bound by contractual data processing agreements that prohibit them from using your data for any purpose other than the specific service they provide to us.

3.1 Categories of Third-Party Recipients

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy framework and regulatory obligations.
• Identity Verification Providers: Third-party KYC and AML screening services may receive your name, date of birth, and document data to perform identity checks and sanctions screening.
• Game Providers: When you play games powered by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, or other certified providers, your session data (including wagers and outcomes) is transmitted to the relevant provider's platform for game operation and audit purposes.
• IT Infrastructure & Security Providers: Cloud hosting, Content Delivery Network (CDN), and cybersecurity vendors may process technical data in the course of providing infrastructure services to 33pok.
• Legal & Regulatory Authorities: We will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosure where legally permitted to do so.

3.2 International Data Transfers

Some of our third-party partners may process data outside Bangladesh. Where international data transfers occur, we take steps to ensure that appropriate safeguards are in place, including contractual clauses that require recipients to uphold data protection standards equivalent to those applied within our platform. By using 33pok, you acknowledge that your data may be transferred to and processed in countries outside Bangladesh in the circumstances described above.

Protecting your personal data is a core operational priority for 33pok. We implement a layered security architecture designed to prevent unauthorised access, disclosure, alteration, or destruction of personal data held on our systems.

5.1 Security Measures

• Transport Encryption: All data transmitted between your browser or app and 33pok servers is encrypted using TLS 1.2 or TLS 1.3 protocols. Our SSL certificate status is publicly verifiable.
• At-Rest Encryption: Sensitive data fields — including identity document images, financial account identifiers, and password hashes — are encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data within 33pok's internal systems is restricted on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and regular security training.
• Penetration Testing: Our platform infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players without undue delay.

5.2 Retention Periods

We retain personal data for as long as necessary to fulfil the purposes described in this policy, subject to the following minimum retention periods:

• Account and KYC data: Retained for a minimum of five years from the date of account closure, in line with standard AML record-keeping obligations.
• Financial transaction records: Retained for a minimum of seven years from the date of each transaction.
• Support correspondence: Retained for three years from the date of the final communication in a thread.
• Technical / usage logs: Retained for twelve months on active infrastructure, then archived for a further twelve months before deletion.
• Marketing consent records: Retained for the duration of your registration and for two years following account closure, as evidence of consent status.

When retention periods expire, data is securely deleted or irreversibly anonymised. You may request early deletion of certain categories of data — see Section 6 for your rights in this regard.

Age verification is an integral part of our KYC process. All players are required to confirm their age at registration and to provide documentary evidence of age before withdrawal requests are processed. Where 33pok becomes aware — through KYC review, parental notification, or any other means — that personal data has been collected from an individual under the age of 18, the following steps will be taken immediately:

• The account will be suspended pending investigation.
• All deposits and wagers associated with the account will be reviewed.
• The account will be permanently closed and all data associated with it will be handled in accordance with our safeguarding obligations.
• Where the deposit funds can be traced to a verifiable payment source belonging to a responsible adult, a return of those funds will be arranged through appropriate channels.

If you are a parent or guardian and believe that a minor in your care has registered on the 33pok platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". We treat all such reports as urgent and will respond within 24 hours of receipt during Bangladesh Standard Time (BST, UTC+6) business hours.

We also recommend that parents and guardians use internet filtering tools and parental control software to restrict access to online gambling platforms on devices used by minors.