rk77 Privacy Policy — How We Collect, Use, and Protect Your Data

rk77 is Bangladesh's trusted online betting and casino platform, operating at rk77.ws. We understand that your personal data is important to you, and we are committed to handling it with the utmost care, transparency, and responsibility. This Privacy Policy sets out in plain, straightforward English exactly how we approach the collection and use of your information.

This policy applies to all users of the rk77 platform, including registered account holders, visitors browsing the site without an account, and individuals who contact rk77 support. By accessing rk77.ws or registering an account, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

Where this Privacy Policy uses the terms "personal data" or "personal information", we mean any information that identifies you or could reasonably be used to identify you as an individual — including your name, mobile number, payment account details, device identifiers, and betting activity records.

For the purposes of this Privacy Policy, rk77 — operating the platform at rk77.ws — is the data controller responsible for your personal data. As data controller, rk77 determines the purposes and means by which your personal data is collected and processed.

All data protection enquiries, subject access requests, and formal privacy complaints should be directed to the rk77 Data Protection contact at the following address:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy — Data Protection Request"
• Response Time: Acknowledgement within 24 hours; resolution within 5 business days
• Support Hours: 24 hours a day, 7 days a week

rk77 appoints a responsible internal contact for data protection matters. Formal complaints that are not resolved to your satisfaction through direct contact may be escalated by marking your email "Formal Privacy Complaint — Escalation" for senior management review.

rk77 collects personal data across several categories, each serving a defined and necessary operational purpose. The following table summarises the categories of personal data we collect, the specific data points within each category, and the primary purpose for which each category is collected:

rk77 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data (other than responsible gaming self-exclusion records), or biometric data beyond identity document photographs used solely for KYC verification.

rk77 collects your personal data through the following primary channels:

• Directly from you: When you complete the account registration form, submit identity documents for KYC verification, make a deposit or withdrawal request, contact rk77 support, or opt in to marketing communications.
• Automatically via platform usage: When you access the rk77 website or platform, our servers automatically record technical data including your IP address, device identifiers, browser type, session duration, pages visited, and in-game activity. This data is collected via server logs and, where applicable, session cookies.
• From payment service providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, or Upay, the relevant payment provider confirms transaction status and associated account reference data to rk77 for the purpose of crediting or debiting your account balance.
• From game content providers: Third-party game providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may transmit game session metadata — including session start and end times, wager amounts, and game outcomes — to rk77 for the purposes of account reconciliation and responsible gaming monitoring.
• From identity verification services: Where rk77 uses third-party document verification tools to assist with KYC processes, those services may return verification status data (pass/fail/pending) to rk77. rk77 does not retain raw biometric data generated by third-party verification tools beyond what is required by its retention obligations.

rk77 uses your personal data for the following specific purposes. Where we rely on a particular legal basis for processing, this is identified in Section 6:

• Account administration: Creating, maintaining, and managing your rk77 player account, including processing login authentication and account settings changes.
• Identity verification: Conducting Know Your Customer (KYC) checks to confirm your age, identity, and ownership of the payment method used — as required for responsible gaming compliance and anti-money-laundering obligations.
• Payment processing: Crediting deposits to your account balance and processing approved withdrawal requests to your registered payment account (bKash, Nagad, Rocket, or Upay).
• Fraud prevention and security: Monitoring account activity and technical signals to detect and prevent unauthorised access, duplicate account creation, money laundering, bonus exploitation, and other prohibited conduct as defined in the rk77 Terms and Conditions.
• Responsible gaming: Monitoring betting patterns and session activity to identify potential problem gambling behaviours, applying deposit limits and self-exclusion restrictions where requested, and maintaining self-exclusion records to prevent re-registration.
• Customer support: Processing and responding to support queries, complaints, and escalations. Support communications are retained for quality assurance and dispute resolution purposes.
• Platform improvement: Analysing aggregated and anonymised usage data to improve the rk77 platform, identify technical issues, and optimise the player experience. This analysis does not involve profiling individual players for commercial targeting.
• Marketing communications: Sending promotional offers, bonus announcements, and seasonal campaign information to players who have opted in to marketing communications. Marketing is always opt-in; you may withdraw consent at any time.
• Legal and regulatory compliance: Retaining records as required by applicable law and responding to lawful requests from competent authorities.

rk77 processes your personal data on the following legal bases, depending on the specific purpose of the processing activity:

• Contractual necessity: Processing required to perform the contract between you and rk77 — including account registration, payment processing, and the delivery of betting and casino services. Without this processing, rk77 cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including Know Your Customer (KYC) identity verification, anti-money-laundering record-keeping, and responding to lawful orders from competent authorities.
• Legitimate interests: Processing carried out in pursuit of rk77's legitimate business interests where those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security monitoring, responsible gaming oversight, and anonymised analytics for service improvement.
• Consent: Processing based on your freely given, specific, and informed consent. rk77 relies on consent exclusively for marketing communications. You may withdraw consent at any time by contacting [email protected], and withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

rk77 does not sell, rent, or trade your personal data to any third party for their own commercial marketing purposes. Data shared with third parties is limited strictly to what is operationally necessary, as described below:

• Payment service providers (bKash, Nagad, Rocket, Upay): rk77 shares transaction reference data with your chosen payment provider solely to initiate and confirm deposit and withdrawal transactions. Each provider operates under its own privacy policy and regulatory obligations.
• Game content providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and others): Third-party game providers receive a session token and account identifier to authenticate your game session. They do not receive your full name, identity documents, or payment details.
• Identity verification services: Where rk77 engages third-party KYC verification tools to assist with document checks, your submitted identity document and selfie may be transmitted to the verification provider. These providers are contractually bound to process data only for the purpose of verification and to delete raw data following the completion of verification.
• Cloud infrastructure and hosting providers: rk77 uses secure cloud infrastructure to host the platform and store account data. Infrastructure providers are contractually bound by data processing agreements and may not use rk77 data for any purpose other than providing the contracted hosting services.
• Legal and regulatory authorities: rk77 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or to protect the rights, property, or safety of rk77, its players, or the public. rk77 will notify you of such disclosures where legally permitted to do so.

All third-party processors engaged by rk77 are required to implement appropriate technical and organisational security measures to protect your personal data and are prohibited from using your data for any purpose other than the specific service they provide to rk77.

rk77 uses a limited set of cookies and similar tracking technologies on the rk77.ws platform to support core functionality and improve the player experience. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the operation of the rk77 platform. They enable session authentication, maintain your logged-in state between pages, and support core security functions. These cookies cannot be disabled without affecting the functionality of the platform.
• Functional cookies: These cookies remember your platform preferences — such as your chosen display settings — so that you do not need to re-enter them on each visit. They are set only where you have interacted with the relevant feature.
• Analytics cookies: rk77 uses anonymised analytics data to understand how players interact with the platform, which pages are most visited, and where technical errors occur. This data is aggregated and does not identify individual players.
• Third-party provider cookies: Some third-party game providers may set their own session cookies within the game iframe environment. These cookies are governed by the respective provider's privacy policy. rk77 does not control third-party provider cookies.

rk77 does not use cross-site tracking cookies, retargeting pixels, or third-party advertising network cookies for commercial profiling of players. You may configure your browser to block or delete cookies at any time; however, disabling strictly necessary cookies will prevent you from logging into your rk77 account.

rk77 retains your personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to our legal and regulatory retention obligations. The following retention periods apply as a general framework:

• Account and registration data: Retained for the duration of your active account, plus a minimum of five years following permanent account closure. This retention period supports anti-money-laundering record-keeping obligations.
• Identity verification (KYC) documents: Retained for a minimum of five years from the date of verification, or five years from account closure, whichever is later. Document images are stored in encrypted format with access restricted to authorised compliance personnel.
• Payment transaction records: Retained for a minimum of five years from the date of each transaction to support financial record-keeping and AML compliance.
• Betting and gaming transaction records: Retained for a minimum of three years from the date of each transaction for dispute resolution and responsible gaming monitoring purposes.
• Support communications: Retained for a minimum of two years from the date of the most recent correspondence in the relevant support thread.
• Self-exclusion records: Retained indefinitely to prevent re-registration of self-excluded players. Where a self-exclusion expires and you seek to re-register, rk77 will conduct a review before reinstating access.
• Marketing consent records: Retained for as long as your consent remains active, plus a minimum of three years following withdrawal of consent to demonstrate compliance.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised and aggregated data (from which no individual player can be identified) may be retained indefinitely for platform analytics purposes.

rk77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security measures include:

• Transport-layer encryption: All data transmitted between your browser or device and the rk77 platform is protected by 256-bit SSL/TLS encryption, ensuring that your account credentials, payment details, and session data cannot be intercepted in transit.
• Encryption at rest: Sensitive personal data — including identity documents and payment account references — is encrypted at rest in rk77's server infrastructure using industry-standard encryption protocols.
• Password security: Account passwords are never stored in plain text. rk77 uses a one-way cryptographic hashing algorithm with per-user salt to store password credentials, ensuring that raw passwords cannot be recovered even in the event of a data breach.
• Access controls: Access to personal data is restricted to rk77 personnel who require it to carry out their specific role. Access is governed by role-based permissions and audit logging. Personnel with access to sensitive data undergo background checks and confidentiality training.
• Infrastructure security: The rk77 platform is hosted on secure cloud infrastructure with firewall protection, intrusion detection systems, and regular vulnerability assessments. Security patches are applied promptly following discovery of vulnerabilities.
• Incident response: rk77 maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to player rights and freedoms, rk77 will notify affected players without undue delay and take immediate remedial action.

While rk77 takes all reasonable steps to protect your personal data, no security system is entirely immune to risk. You can help protect your own account by using a strong, unique password and by never sharing your login credentials with any third party.

As an rk77 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, contact rk77 at [email protected] with the subject line "Privacy — Data Rights Request". rk77 will acknowledge your request within 24 hours and respond in full within five business days.

• Right of access: You have the right to request a copy of all personal data that rk77 holds about you, along with information about how it is used, who it is shared with, and how long it will be retained.
• Right to rectification: You have the right to request that any inaccurate or incomplete personal data held by rk77 be corrected or updated promptly.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there are no overriding legitimate grounds. This right is subject to rk77's legal retention obligations — data required by law to be retained cannot be erased at your request.
• Right to restriction of processing: You may request that rk77 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while a complaint is under investigation.
• Right to data portability: Where processing is carried out by automated means and based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing of your personal data where rk77 relies on legitimate interests as its legal basis. rk77 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where rk77 processes your data on the basis of consent (i.e., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

rk77 will not charge a fee for processing data rights requests submitted in good faith. Where requests are manifestly unfounded or repetitive, rk77 reserves the right to charge a reasonable administrative fee or decline to act, with written explanation provided.

rk77 does not knowingly collect, process, or retain personal data from any individual under the age of 21. The rk77 platform is strictly for adults aged 21 and above, and rk77 implements age verification measures as part of its KYC process to enforce this policy.

If rk77 discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age — whether through registration, deposit activity, or any other means — rk77 will immediately suspend the relevant account, delete all associated personal data to the extent permitted by legal retention obligations, and reverse any financial transactions attributable to the account.

If you are a parent or guardian and believe that your child (under 21) has registered an account or provided personal data to rk77 without your knowledge, please contact [email protected] immediately. rk77 will investigate and take appropriate action as a matter of priority.

The rk77 platform may display references to third-party payment providers (bKash, Nagad, Rocket, Upay) and third-party game content providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and others) in the course of normal platform operation. These third parties operate under their own independent privacy policies, over which rk77 has no control.

rk77 is not responsible for the privacy practices or data security standards of any third-party provider. We encourage you to review the privacy policies of your chosen payment provider and any game provider whose content you access through the rk77 platform. The presence of third-party integrations on the rk77 platform does not constitute an endorsement of those providers' privacy practices.

rk77 reserves the right to amend, update, or replace this Privacy Policy at any time. Where amendments are material — meaning they substantially affect the way your personal data is collected, used, or shared — rk77 will notify registered players via the mobile number or email address associated with their account at least 7 days before the revised policy takes effect.

Minor amendments — such as corrections of typographical errors, clarifications of existing provisions, or updates to reflect changes in third-party provider arrangements — may be made without advance notice and will take effect immediately upon publication on the rk77 platform. The "Effective Date" displayed at the top of this policy reflects the date on which the current version came into force.

Your continued use of the rk77 platform following the publication of any amendment to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with any amendment, you must cease using the rk77 platform and contact [email protected] to request account closure.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way rk77 handles your personal data, please contact the rk77 support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Privacy Requests: "Privacy — Data Protection Request"
• Subject Line for Formal Complaints: "Formal Privacy Complaint — Escalation"
• Support Hours: 24 hours a day, 7 days a week, including Bangladesh public holidays
• Acknowledgement Time: Within 24 hours of receipt
• Resolution Target: Within 5 business days for standard requests

rk77 is committed to resolving all privacy-related queries and complaints fairly, transparently, and in a timely manner. Where a complaint cannot be resolved to your satisfaction through direct communication with rk77 support, you may escalate the matter by writing to the same email address marked "Formal Privacy Complaint — Escalation" for review by senior management.