dbdok Privacy Policy
How We Protect Your Data

dbdok is an online sports betting and casino platform operating at dbdok.io, serving players across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. dbdok is the data controller responsible for the personal data collected and processed through the platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data dbdok holds about you, please contact the dbdok privacy team using the following details. All contact information is provided as plain text for reference only and is not a clickable link:

• Email: [email protected]
• Subject line: "Privacy Request — [Your Username]"
• Response time: dbdok will acknowledge privacy-related queries within 24 hours and provide a full response within 10 business days
• Support availability: 24/7, Bangladesh Standard Time (UTC+6)

For responsible gaming concerns related to personal data held in connection with self-exclusion or deposit limit records, please refer to the Responsible Gaming page for additional guidance.

dbdok collects the following categories of personal data in connection with your use of the platform:

The data types listed above represent the full scope of personal data dbdok may collect. Not all categories will apply to every player. For example, passport data is only collected where a player opts to use a passport as their KYC document.

dbdok collects personal data through the following channels and mechanisms:

• Direct collection from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact the support team, or update your account profile, you directly provide personal data to dbdok.
• Automated collection during platform use: When you browse the dbdok platform, place bets, play games, or navigate between sections, technical and usage data is collected automatically through server logs, session tracking, and first-party cookies. This data is used to maintain platform security, detect fraudulent sessions, and improve platform performance.
• Payment provider data: When you deposit or withdraw funds using bKash, Nagad, Rocket, Upay, Visa, or Mastercard, dbdok receives transaction confirmation data from the payment provider. This data includes transaction reference numbers, timestamps, and the registered mobile number or card details associated with the transaction. dbdok does not store full card numbers.
• Identity verification providers: Where dbdok uses third-party identity verification services to assist with KYC processing, those providers may supply verification outcome data (confirmed/failed) and document authenticity scores to dbdok. The underlying document images are processed in accordance with the verification provider's own privacy controls.
• Device and browser data: Standard technical data — including your IP address, device identifiers, browser type, and operating system — is collected automatically upon each session to support fraud prevention, geolocation compliance, and account security monitoring.

dbdok processes your personal data on the following legal bases, depending on the purpose for which the data is used:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary for dbdok to deliver the services described in the Terms & Conditions — including account management, transaction processing, KYC verification, and support services. Without this data, dbdok cannot operate your account.
• Compliance with legal obligations: Certain processing activities — including KYC verification, anti-money laundering checks, fraud detection, and record retention — are carried out because they are required by applicable law. dbdok must retain transaction and identity records for a defined statutory period regardless of account closure.
• Legitimate interests: dbdok processes technical and usage data on the basis of its legitimate interest in maintaining platform security, preventing fraud, improving service quality, and protecting the integrity of betting markets. This processing does not override players' fundamental privacy interests where appropriate safeguards are in place.
• Consent: Where dbdok sends promotional communications — including information about bonuses, seasonal promotions tied to BPL, IPL, Eid, or Pohela Boishakh, and new game announcements — it does so on the basis of consent provided during registration. You may withdraw this consent at any time without affecting your ability to use the platform.

dbdok uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, verify your identity, maintain your account profile, and process account changes such as password resets and contact detail updates.
• Transaction processing: To process deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; to reconcile transaction records; and to investigate disputed transactions at a player's request.
• KYC and age verification: To confirm that you meet the 21+ age requirement and to verify that your identity matches the registration details provided. This is a legal compliance obligation as well as a player protection measure.
• Betting and gaming services: To allow you to place bets on cricket (BPL, IPL, T20 World Cup, Bangladesh Tigers matches), play live casino games, access slots, and use all other features of the platform.
• Fraud prevention and security: To monitor accounts and transactions for signs of fraudulent activity, money laundering, multi-accounting, use of automated betting tools, and other prohibited activities defined in the Terms & Conditions.
• Responsible gaming: To record, enforce, and maintain the responsible gaming settings you activate — including deposit limits, loss limits, cooling-off periods, and self-exclusion records.
• Customer support: To respond to your enquiries, complaints, and formal dispute submissions; to maintain a record of support interactions for quality assurance and escalation purposes.
• Platform improvement: To analyse aggregated usage patterns and technical performance data, in anonymised or pseudonymised form where possible, to improve the platform's features, navigation, and overall player experience.
• Marketing communications: To send you information about bonuses, promotions, new games, and seasonal offers — where you have provided consent to receive such communications.

dbdok does not use personal data for automated decision-making that produces legal or similarly significant effects on players, except in the context of fraud detection systems where suspicious activity patterns trigger an automated account review flag, subject to subsequent human review by the dbdok compliance team.

6.1 No Sale of Personal Data. dbdok does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is not used for advertising networks, data brokers, or any form of third-party profiling.

6.2 Authorised Service Providers. dbdok shares personal data with a limited set of third-party service providers who assist in operating the platform. These providers are contractually obligated to process data only as instructed by dbdok and to maintain appropriate security standards. The categories of authorised service providers are:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard — for the purpose of processing deposits and withdrawals in BDT.
• Identity verification providers: Third-party KYC service providers used to verify NID documents, passport data, and mobile banking account ownership.
• Game content providers: Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe — who receive session data necessary to deliver live casino and slot game content via their platforms. These providers operate under their own data processing agreements with dbdok.
• IT infrastructure and hosting providers: Cloud hosting and content delivery providers used to operate the platform's technical infrastructure. These providers do not have access to player data beyond what is technically necessary for service delivery.
• Fraud prevention and analytics providers: Third-party services that assist dbdok in detecting suspicious account activity, bot usage, and multi-accounting patterns.

6.3 Legal Disclosures. dbdok may disclose personal data to law enforcement authorities, regulatory bodies, or courts in Bangladesh where required to do so by applicable law, court order, or in response to a valid legal process. dbdok will, where permitted by law, notify the affected player of any such disclosure request prior to compliance.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or part of dbdok's business operations, player personal data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and of any changes to this Privacy Policy that result from it, in advance where reasonably practicable.

7.1 What Are Cookies. Cookies are small text files placed on your device by the dbdok platform when you visit. They allow the platform to recognise your device across sessions, maintain your login state, and record preferences. dbdok uses first-party cookies only — it does not embed third-party advertising cookies or cross-site tracking scripts.

7.2 Types of Cookies Used by dbdok.

7.3 Managing Cookies. You may configure your browser to refuse or delete cookies. Disabling essential cookies will prevent you from logging into your dbdok account and will impact core platform functionality. Disabling analytics cookies will not affect your ability to use the platform. Instructions for managing cookies in common browsers are available in your browser's help documentation.

dbdok maintains a multi-layered technical and organisational security framework to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. The key security measures in place include:

• 256-bit SSL/TLS encryption on all data transmitted between players' devices and the dbdok platform, including login sessions, account pages, deposit and withdrawal flows, and support interactions.
• One-way password hashing using industry-standard cryptographic algorithms. Player passwords are never stored in recoverable plain text. Even dbdok's own internal systems cannot retrieve a player's password — only a password reset is possible.
• Access controls: Internal access to personal data is restricted to dbdok staff on a strict need-to-know basis. All internal access is logged and subject to periodic audit review.
• Session security: Active sessions are protected against hijacking using secure, HttpOnly, and SameSite cookie attributes. Sessions automatically expire after a period of inactivity.
• Anomaly detection: dbdok's systems monitor for login anomalies — including logins from unrecognised IP addresses or devices, multiple failed password attempts, and rapid geographic changes in session location — and may trigger additional verification steps or temporary account locks in response.
• Secure data storage: All personal data at rest is stored on encrypted servers. Physical and network access to server infrastructure is restricted to authorised personnel only.

Despite these measures, no internet-based platform can guarantee absolute security. Players are encouraged to protect their accounts by using a strong, unique password and logging out after every session, particularly on shared or public devices.

9.1 Retention Principles. dbdok retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. Once the applicable retention period has elapsed, personal data is either securely deleted or anonymised so that it can no longer be linked to an individual player.

9.2 Retention Periods by Data Category.

9.3 Account Closure and Data. When a player requests account closure, dbdok will cease using personal data for active account management purposes immediately. However, relevant data categories will be retained for the statutory periods set out above to meet legal obligations and to handle any post-closure disputes or regulatory enquiries that may arise.

As a registered player on the dbdok platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the dbdok support team at [email protected] with the subject line "Data Rights Request — [Your Username]".

• Right of Access: You have the right to request a copy of the personal data dbdok holds about you. dbdok will provide this information in a structured, commonly used format within 10 business days of a verified request.
• Right to Rectification: If any personal data held by dbdok is inaccurate or incomplete, you have the right to request that it be corrected. For KYC-related data, corrections may require submission of updated documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected and where dbdok is not subject to a legal obligation requiring its continued retention. Erasure requests for data subject to legal retention obligations (e.g., AML records) will be declined with an explanation.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of data held by dbdok — you may request that processing of that data be restricted while the accuracy is verified.
• Right to Data Portability: Where personal data has been provided by you directly and is processed on the basis of consent or contractual necessity, you may request a machine-readable copy of that data for transfer to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent — in particular, marketing communications — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.
• Right to Object: You may object to processing carried out on the basis of dbdok's legitimate interests. dbdok will assess the objection and cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

dbdok does not charge a fee to process data rights requests and will respond within 10 business days of receiving a verified request. Where a request is complex or involves a large volume of data, dbdok may extend the response period by up to an additional 10 business days, with prior notification to the player.

The dbdok platform is strictly for adults aged 21 years and above. dbdok does not knowingly collect personal data from any individual under the age of 21. The 21+ age requirement is enforced through the registration process and KYC verification procedures described in this policy and in the Terms & Conditions.

If dbdok becomes aware that personal data has been collected from a person under the age of 21 — whether through a registration irregularity, a parent or guardian notification, or an internal audit — the following steps will be taken immediately:

• The account will be suspended pending investigation .
• Any funds held in the account will be handled in accordance with the Terms & Conditions governing underage account closure.
• All personal data associated with the underage account will be permanently deleted from dbdok's systems as soon as the investigation is concluded and any mandatory regulatory reporting obligations are fulfilled.
• The account will be permanently closed and the associated identity documents flagged to prevent re-registration.

Parents or guardians who believe a minor has registered on the dbdok platform should contact the support team immediately at [email protected] with the subject line "Underage Account Report". dbdok treats such reports with the highest priority and will respond within 24 hours. For further guidance on protecting younger family members from accessing gambling platforms, please visit our Responsible Gaming page.

12.1 Policy Updates. dbdok reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, platform features, data processing practices, or third-party service provider relationships. The most current version of the Privacy Policy will always be published at dbdok.io/privacy-policy and will display the effective date at the top of the document.

12.2 Notification of Material Changes. Where a change to this Privacy Policy is material — meaning it significantly affects the way dbdok collects, uses, or shares personal data — dbdok will notify registered players by email to the address held on the player's account, or by a prominent notice displayed within the platform at login. Notification will be provided at least 14 days before the material change takes effect, except where a shorter period is required by law.

12.3 Continued Use as Acceptance. Your continued use of the dbdok platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes to this Privacy Policy, you should discontinue use of the platform and contact [email protected] to request account closure. Account closure does not affect dbdok's right to retain data for the statutory periods set out in Section 9.

12.4 Version Archive. Prior versions of the dbdok Privacy Policy are available on request by emailing [email protected] with the subject line "Privacy Policy Version Request".

For all privacy-related enquiries, data access requests, consent withdrawal, or security reports, use the contact details below. All details are provided as plain text only and are not clickable links.

• Email: [email protected]
• Subject line format: "Privacy Request — [Your Username] — [Request Type]"
• Availability: 24/7, Bangladesh Standard Time (UTC+6)
• Response time: Acknowledgement within 24 hours; full response within 10 business days
• Escalation: If you are not satisfied with dbdok's response to a privacy request, you may submit a formal escalation by emailing [email protected] with the subject line "Privacy Escalation — [Your Username]". A senior review will be completed within 10 further business days.

For responsible gaming data requests — including enquiries about self-exclusion records, deposit limit history, or cooling-off period logs — please reference the Responsible Gaming page before contacting support, as it contains guidance specific to those data types.