Privacy Policy — How tk10b Protects Your Data

Introduction

This Privacy Policy ("Policy") describes how tk10b ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and protects personal information relating to individuals ("you", "your", "Player", "User") who register for, access, or use the tk10b online betting and casino service available at https://tk10b.io and any associated mobile-optimised interfaces.

This Policy is an integral part of the tk10b Terms & Conditions. By registering an account, depositing funds, placing a bet, or otherwise using the Platform, you acknowledge that you have read, understood, and agreed to this Policy. If you do not agree to the collection and use of your information as described herein, you must not use the Platform.

This Policy is written in English. In the event of any translation or interpretation dispute, the English-language version shall prevail. Our primary audience is players located in Bangladesh, and we apply the same robust data handling standards to all users regardless of location.

Data Controller

tk10b operates as the data controller in respect of all personal data collected through the Platform. As data controller, tk10b determines the purposes for which personal data is collected and the means by which it is processed.

All data-related inquiries, access requests, and formal complaints should be directed to our designated data point of contact at [email protected]. This address is provided as plain text and is not a clickable link — please copy and paste it into your email client.

tk10b is an offshore gaming platform. While we apply data protection standards consistent with internationally recognised best practices, players are responsible for understanding the data protection laws applicable in their own jurisdiction.

Data We Collect

tk10b collects the following categories of personal data. We have organised these into a reference table for clarity:

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or health information, unless a specific legal obligation requires it in connection with a responsible gaming assessment.

How Data Is Collected

tk10b collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing identity verification, making a deposit or withdrawal request, contacting support, or participating in a promotion.
• Automated technologies: Technical and usage data collected automatically as you navigate the Platform, including through cookies, session tracking, and server logs. See Section 9 for full details on our cookie practices.
• Third-party payment processors: Transaction confirmation data passed to us by bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment partners when you initiate a deposit or withdrawal.
• Identity verification services: Where we use a third-party KYC provider to verify government-issued identification documents, that provider shares a verification result and document type with us. We do not receive raw document images from third-party KYC providers beyond what is necessary for the verification decision.
• Game providers: Aggregated game activity data provided by our game supply partners (including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe) for the purpose of game history reconciliation and dispute resolution.
• Fraud prevention services: Risk signals and device fingerprint data from fraud prevention tools used to detect and prevent account takeover, multi-accounting, and financial fraud.

Purposes & Legal Basis for Processing

tk10b processes your personal data only where a valid lawful basis exists for doing so. The table below maps each processing purpose to its lawful basis:

Where processing is based on consent (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

Where processing is based on our legitimate interests, we have assessed that those interests are not outweighed by your rights and interests as a data subject. You have the right to object to such processing — see Section 12 for details.

Data Sharing

tk10b does not sell your personal data to any third party. We share your data only in the following limited circumstances:

• Payment processors: We share the minimum data necessary (such as your account reference and transaction amount) with bKash, Nagad, Rocket, Upay, and banking partners to process your financial transactions.
• Identity verification providers: We share your submitted identity documents with KYC service providers solely for the purpose of verifying your identity and age. These providers act as data processors under contractual obligations.
• Game providers: Session tokens and player IDs are shared with game supply partners (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe) to launch game sessions and reconcile game history. Game providers do not receive your full personal profile.
• Fraud and security vendors: Technical data (IP address, device fingerprint, session metadata) may be shared with fraud prevention service providers to detect and prevent account takeover, bonus abuse, and financial crime.
• Legal and regulatory authorities: We may disclose your personal data to law enforcement agencies, courts, or regulatory bodies where required by law, court order, or valid legal process, or where disclosure is necessary to protect the safety and rights of tk10b, its staff, or other players.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of tk10b's assets, your personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection obligations.

All third parties with whom we share personal data are required to handle that data in a manner consistent with this Policy and applicable data protection standards. We do not permit our service providers to use your data for their own commercial purposes.

International Data Transfers

tk10b operates as an offshore gaming platform and your personal data may be processed in jurisdictions outside Bangladesh. When we transfer personal data to countries that do not have data protection laws equivalent to internationally recognised standards, we implement appropriate safeguards, which may include:

• Contractual clauses that impose data protection obligations on the recipient party.
• Binding corporate rules where data is transferred within a group of companies.
• Technical measures such as end-to-end encryption that protect data in transit regardless of jurisdiction.

By using the tk10b Platform, you acknowledge that your personal data may be transferred to and processed in countries outside your country of residence. We take reasonable steps to ensure that any such transfers are subject to appropriate protections.

Data Retention

tk10b retains personal data for as long as is necessary to fulfil the purposes outlined in this Policy, subject to the following retention schedules:

• Active account data: Retained for the lifetime of your account and for a period of 7 years following permanent account closure, to satisfy our record-keeping and compliance obligations.
• Financial transaction records: Retained for a minimum of 7 years from the date of each transaction, in line with standard financial record-keeping obligations.
• KYC / identity documents: Retained for a period of 5 years following the completion of the verification process, or for the duration required by applicable law if longer.
• Support communications: Live chat transcripts and email correspondence are retained for 3 years from the date of the interaction, to support dispute resolution and quality assurance.
• Marketing preferences and consent records: Retained for 3 years from the date of last interaction or until consent is withdrawn, whichever is earlier. Proof of consent is retained for the same period after opt-out.
• Technical / log data: Server logs and session data are retained for a rolling period of 12 months, after which they are automatically purged or anonymised.

When personal data is no longer required for any of the purposes above, it is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

Cookies & Tracking Technologies

tk10b uses cookies and similar tracking technologies (collectively "Cookies") to operate and improve the Platform. Cookies are small text files placed on your device when you access the Platform. They allow us to recognise your device, remember your preferences, maintain your session, and analyse how the Platform is used.

We use the following categories of Cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies, security tokens, and load-balancing identifiers. These Cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and notification opt-in status. Disabling these Cookies may affect your Platform experience.
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how users navigate the Platform — pages viewed, session duration, error events — to help us improve the user experience. We use internal analytics tools; we do not share raw analytics data with third-party advertising platforms.
• Fraud Prevention Cookies: Used to maintain device fingerprint data that helps us detect and prevent fraudulent account access, multi-accounting, and bonus abuse.

You can manage Cookie preferences through your browser settings. Most modern browsers allow you to block or delete Cookies. Note that blocking Strictly Necessary Cookies will prevent you from logging in to your tk10b account. For instructions on managing Cookies in your specific browser, refer to your browser's help documentation.

Security Measures

tk10b implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS 1.3 encryption for all data transmitted between your device and the Platform.
• AES-256 encryption for all personal data stored at rest on our servers.
• Bcrypt hashing for all stored password credentials — we never store plaintext passwords.
• Role-based access controls that limit internal access to personal data to authorised personnel with a documented business need.
• Regular security assessments and penetration testing conducted by qualified third-party security professionals.
• Automated anomaly detection systems that flag unusual login patterns or access attempts for immediate review.
• Segregation of player funds from operational funds in designated accounts, reducing the data surface area in operational systems.

While tk10b takes every reasonable precaution to protect your data, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for ensuring that you access the Platform from secure devices and networks. If you suspect that your account has been compromised, contact our support team immediately via live chat.

Minors

tk10b strictly enforces a minimum age requirement of 21 years for all registered users. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes age verification steps, and we reserve the right to request documentary proof of age at any point.

If tk10b discovers or reasonably suspects that personal data has been collected from a minor, the affected account will be suspended immediately, all associated data will be reviewed, and the account will be permanently closed. Any funds deposited by a minor will be returned via the original payment method after identity confirmation.

If you are a parent or guardian and believe that a minor in your household has created a tk10b account or that their personal data has been collected without appropriate consent, please contact us immediately at [email protected] (plain text — not a clickable link) so that we may take prompt corrective action.

Your Rights

As a data subject, you hold the following rights in respect of your personal data held by tk10b. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Subject Request" and include your registered username and the nature of your request.

• Right of Access: You may request a copy of all personal data we hold about you. We will provide this within 30 days of receipt of a valid request, free of charge for the first request in any 12-month period.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data. For basic account details (email address, phone number), you may update these directly from your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. Note that some data must be retained to fulfil our legal obligations (see Section 8) and erasure requests cannot override these obligations.
• Right to Restriction of Processing: You may request that we restrict processing of your data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection is being assessed.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request a structured, machine-readable copy of the personal data you have provided to us.
• Right to Object: You may object at any time to processing of your personal data based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights, or unless processing is necessary for legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to the withdrawal.

We aim to respond to all data subject requests within 30 calendar days. In cases of particular complexity or volume, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

Complaints

If you believe that tk10b has handled your personal data in a manner that is inconsistent with this Privacy Policy or with your rights as a data subject, we encourage you to raise the matter with us in the first instance by contacting [email protected] with the subject line "Privacy Complaint". We take all privacy complaints seriously and will acknowledge receipt within 5 business days and provide a substantive response within 30 calendar days.

If you are not satisfied with our response, or if you wish to escalate your concern directly to a supervisory authority, you should seek guidance from the data protection regulator applicable in your jurisdiction. tk10b will cooperate with any lawful inquiry from a competent supervisory authority.

Policy Changes

tk10b reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, legal obligations, or regulatory guidance. When we make material changes to this Policy, we will notify registered players via the email address associated with their account and will display a prominent notice on the Platform upon next login.

The "Last Updated" date at the top of this document reflects the date on which the current version came into effect. We encourage you to review this Policy periodically, particularly before making a deposit or providing additional personal information.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and close your account in accordance with Section 13 of the Terms & Conditions.

Contact Us

For all privacy-related queries, data subject requests, and formal complaints, please contact the tk10b data team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Subject Request" to ensure your message is routed to the correct team. This address is provided as plain text only and is not a clickable link.
• Live Chat: Available 24 hours a day, 7 days a week through the Platform, operating on Bangladesh Standard Time (BST, UTC+6). Live chat is the fastest channel for urgent account-related privacy matters.

tk10b aims to acknowledge all privacy inquiries within 2 business days and to provide a full response within 30 calendar days. For data subject access requests, we may ask you to verify your identity before we process the request, to protect the privacy of all users.