ok37 Privacy Policy — Your Data, Your Rights

When you register an account on ok37, we collect: your mobile phone number (used as your primary account identifier); a password of your choosing; your date of birth (to verify you are 21 or older); your full name (collected during identity verification); and any additional information you voluntarily provide when contacting our support team, such as the nature of a complaint or enquiry. If you are required to complete KYC verification before a withdrawal, we may also collect a copy of a government-issued identity document.

When you access or use the ok37 platform, our servers automatically record certain technical information. This includes: your IP address and approximate geographic location derived from it; the type and version of browser or app you are using; your device type and operating system; pages visited and features used within the platform; session start and end times; game session data including bets placed, outcomes, and wager amounts; and cookie identifiers (see the Cookies section below). This technical data helps us maintain platform stability, detect fraud, and improve the player experience.

When you make a deposit or request a withdrawal via bKash, Nagad, Rocket or Upay, the payment provider confirms the transaction to ok37 and shares certain transaction metadata with us, including the registered mobile number associated with the payment account, the transaction reference number, the amount, and the transaction status. ok37 does not receive or store full mobile banking PINs or passwords — only transaction confirmation data that we need to credit your ok37 wallet or process your withdrawal correctly.

ok37 shares limited personal data with third-party service providers who help us operate the platform. This includes our payment processing partners (bKash, Nagad, Rocket, Upay), game content providers (such as Evolution Gaming and Pragmatic Play), fraud detection service providers, and cloud hosting infrastructure providers. These partners are given access only to the data they need to perform their specific function and are required to process that data in accordance with our instructions and applicable data protection standards.

ok37 may disclose personal data where required to do so by applicable law, court order, or regulatory authority. This may include disclosures in connection with anti-money laundering investigations, fraud enquiries, or other law enforcement matters. Where we are legally permitted to do so, we will attempt to notify you before disclosing your personal data in response to such a request.

If ok37 is involved in a merger, acquisition, or sale of all or part of its business assets, personal data held by ok37 may be transferred as part of that transaction. In such circumstances, we will take reasonable steps to ensure that the acquiring entity applies data protection standards equivalent to those described in this Privacy Policy, and will notify affected players via their registered mobile number or contact details before any transfer of their personal data takes place.

ok37 retains your personal data for as long as your account is active and for a period of up to five years after account closure, in order to comply with our record-keeping obligations, resolve any outstanding disputes, and cooperate with any regulatory enquiries that may arise after closure. Game transaction records and financial data may be retained for longer periods where required by applicable financial regulations. Anonymised or aggregated data (from which you cannot be individually identified) may be retained indefinitely for statistical and analytical purposes.

In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, ok37 will take immediate steps to contain the breach, assess its scope and impact, and notify affected players as quickly as practicable via their registered mobile number. We will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps we have taken or propose to take to address it. We maintain an internal incident response plan for this purpose.