Privacy Policy — How tk917 Protects Your Personal Data

For the purposes of this Privacy Policy, the data controller is tk917, operating the online casino and sports betting platform at tk917.io. The data controller is responsible for deciding how and why your personal data is processed.

All data-related correspondence, including requests to exercise your rights, should be directed to the tk917 Data Protection team at: [email protected]. Please include "Privacy Request" in the subject line of your email to ensure your enquiry is routed to the correct department.

tk917 collects only the data necessary to operate the platform, comply with legal obligations, and provide a safe gaming environment. The categories of personal data we may hold about you are set out in the table below.

tk917 does not intentionally collect sensitive special-category data (such as racial or ethnic origin, religious beliefs, or health information) unless this is directly relevant to a responsible gaming assessment requested by the player.

tk917 collects personal data through three primary channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account preferences, you provide data to us directly.
• Automatically through technology: When you visit tk917.io, our servers and cookies automatically record Technical Data including your IP address, browser type, device identifiers, and session behaviour. This happens on every page visit regardless of whether you are logged in.
• From third-party service providers: Payment processors (such as bKash, Nagad, and Rocket) may share transaction confirmation data with tk917 to reconcile deposits and withdrawals. Identity verification partners may share the results of document authenticity checks. Game providers may share individual session outcomes for dispute resolution purposes.

tk917 does not purchase personal data from data brokers, marketing list providers, or any other third-party data vendors.

tk917 processes personal data for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed here without first obtaining your separate consent.

• Account creation and management: To register your player account, verify your identity, maintain your account settings, and communicate with you about account-related matters.
• Payment processing: To process deposits and withdrawals via approved payment methods including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card networks. Financial data is required to match transactions to player accounts and satisfy anti-money-laundering obligations.
• KYC and fraud prevention: To verify that you meet the minimum age requirement of 21 years, confirm the legitimacy of deposited funds, detect and prevent fraudulent activity, and comply with know-your-customer obligations.
• Responsible gaming compliance: To implement deposit limits, session reminders, cool-off periods, and self-exclusion requests at the player's direction, and to monitor gameplay patterns for signs of problem gambling behaviour.
• Customer support: To respond to enquiries, resolve disputes, and maintain records of communications for quality assurance and legal purposes.
• Legal and regulatory compliance: To fulfil obligations under applicable international gaming regulations, anti-money-laundering standards, and data protection principles.
• Platform security: To detect unauthorised access attempts, bot activity, collusion, and other prohibited conduct as described in the Terms & Conditions.
• Marketing communications (with consent only): To send you promotional offers, bonus notifications, and seasonal promotions (such as BPL, IPL, Eid, and Pohela Boishakh specials) where you have opted in to receive marketing messages. You may withdraw consent at any time via account settings.
• Platform improvement: To analyse aggregated, anonymised usage data in order to improve the platform's performance, game selection, and user experience.

tk917 processes personal data under the following legal bases, consistent with internationally recognised data protection principles:

tk917 does not sell your personal data to any third party. We may, however, share data with carefully selected partners and service providers in the following circumstances:

• Payment processors: Transaction data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Sonali Bank, Visa, and Mastercard solely for the purpose of executing deposit and withdrawal instructions.
• Identity verification providers: KYC document data may be processed by third-party identity verification services to confirm the authenticity of submitted documents. These providers are contractually bound to process data only for verification purposes.
• Game providers: Individual session data is shared with providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to the extent necessary to resolve game disputes and ensure technical integrity.
• IT infrastructure and hosting providers: tk917 uses cloud hosting and database services whose staff may have incidental access to player data within the scope of infrastructure management duties, subject to confidentiality agreements.
• Legal and regulatory authorities: tk917 may disclose personal data to law enforcement bodies, regulatory agencies, or courts of competent jurisdiction where required by a valid legal obligation, court order, or regulatory directive.
• Business succession: In the event of a merger, acquisition, or sale of the tk917 business, player data may be transferred to the successor entity, subject to the same privacy protections described in this policy. Players will be notified of any such transfer.

tk917 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

Once a retention period expires, data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual.

tk917 employs a multi-layered security architecture to protect personal data from unauthorised access, accidental loss, disclosure, alteration, or destruction. Key security measures in place include:

• 256-bit SSL/TLS encryption on all data in transit between your browser or device and the tk917 servers.
• Encryption at rest for all sensitive personal data stored in tk917's databases, using industry-standard AES-256 encryption.
• Password hashing — account passwords are never stored in plain text. tk917 uses a strong cryptographic hashing algorithm with per-user salts.
• Access controls — access to production systems containing personal data is restricted to authorised personnel on a strictly need-to-know basis. All access is logged and audited.
• Intrusion detection systems — tk917 operates continuous network monitoring to identify and respond to potential security threats in real time.
• Regular security audits — the platform undergoes periodic third-party security assessments and penetration testing.
• Data breach response protocol — in the event of a personal data breach that poses a risk to players, tk917 will notify affected players without undue delay and take immediate steps to contain and remediate the breach.

tk917 uses cookies and similar tracking technologies on the tk917.io website to provide a functioning platform, remember your preferences, and gather anonymised analytics about how the platform is used. The categories of cookies in use are as follows:

• Strictly Necessary Cookies: These are essential for the platform to function. They manage your authenticated session, maintain your wallet state, and enable the shopping basket functionality for in-platform transactions. These cookies cannot be disabled without preventing core platform functions.
• Performance and Analytics Cookies: These collect anonymised data about page visits, session duration, and navigation paths to help us understand how players use the platform and where technical improvements are needed. Data collected by these cookies is aggregated and does not identify individual users.
• Functionality Cookies: These remember your stated preferences such as display settings, language selection, and responsible gaming tool configurations so you do not need to re-enter them on each visit.
• Marketing Cookies (opt-in only): These are set only where you have explicitly consented to receive personalised promotional content. They allow tk917 to measure the effectiveness of promotional campaigns and deliver relevant offers. You may withdraw consent for marketing cookies at any time via your account settings.

Most web browsers allow you to control cookies through browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the tk917 platform. Disabling performance or functionality cookies will not prevent access but may degrade your user experience.

tk917 recognises and respects your rights in relation to your personal data, consistent with internationally recognised data protection principles. The rights available to you are summarised below. To exercise any of these rights, contact [email protected] with "Privacy Request" in the subject line. tk917 will respond within 30 days of receiving a valid request.

Please note that certain rights are subject to legal exceptions. For example, tk917 cannot delete KYC and transaction data that it is legally required to retain under anti-money-laundering obligations. Where an exception applies, tk917 will explain the reason in its response to your request.

As part of the KYC process, tk917 requires all players to submit valid government-issued photo identification confirming that they are aged 21 or older. This verification step is mandatory before any withdrawal can be processed and may be requested at any point during a player's use of the platform.

If you are a parent or guardian and believe that a person under 21 has registered on tk917 using false information, please contact us immediately at [email protected] so that we can investigate and take appropriate action, including account closure and data deletion.

tk917 reserves the right to update this Privacy Policy at any time to reflect changes in the platform, applicable law, or industry best practices. When a material change is made, tk917 will:

• Update the "Last Updated" date at the top of this document.
• Notify registered players via email or a prominent in-platform notification at least 14 days before the revised policy takes effect, where the change is material to how their data is processed.
• In cases where a change requires fresh consent (e.g., a new processing purpose), present a clear consent request to affected players before proceeding.

Your continued use of the tk917 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the platform and contact [email protected] to request account closure and data deletion, where legally permissible.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way tk917 processes your personal data, please contact us using the details below. All data-related enquiries are handled by the tk917 Data Protection team.

• Email: [email protected] — please include "Privacy Request" in the subject line.
• Live Chat: Available 24 hours a day, 7 days a week directly within the platform. State at the start of your chat that you have a privacy-related enquiry.
• Response Time: tk917 aims to acknowledge all privacy requests within 48 hours (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.
• Language: All formal privacy correspondence is conducted in English, which is the authoritative language of this policy.

This Privacy Policy is published in English. The English language version is the sole authoritative version. Any translation provided for convenience is non-binding and does not supersede the English original.