Privacy Policy — Your Data at ddok
At ddok, protecting your personal data is a core responsibility, not an afterthought. This Privacy Policy explains exactly what information we collect when you use our platform, how we use it, who we share it with, and what rights you hold as a ddok account holder in Bangladesh.
Six Core Principles That Guide How ddok Handles Your Data
These cards offer a plain-English summary. They do not replace the full legal text below — please read the complete policy for your full rights and obligations under this agreement.
We Collect Only What We Need
ddok collects personal data that is strictly necessary for account registration, identity verification, payment processing, and platform security. We do not collect data for its own sake, and we do not build marketing profiles for sale to third parties outside our operational partners.
Your Data Is Encrypted End-to-End
All data transmitted between your device and the ddok platform travels over TLS/SSL-encrypted connections. Sensitive fields such as payment wallet numbers and Bangladeshi National ID references are stored using industry-standard encryption at rest and are never held in plain text on our servers.
Limited Third-Party Sharing
ddok shares your personal data only with a carefully selected set of service partners — payment processors (bKash, Nagad, Rocket, Upay), identity verification providers, certified game studios (such as Pragmatic Play and Evolution Gaming), and fraud prevention tools. We never sell your data to unaffiliated advertisers.
You Control Your Marketing Preferences
Promotional SMS messages and platform notifications are opt-in by default at registration. You may withdraw your marketing consent at any time via your account settings dashboard or by contacting the support team. Opting out of marketing does not affect transactional notifications such as deposit and withdrawal confirmations.
Defined Data Retention Periods
ddok retains your personal data only for as long as required to fulfil the purposes for which it was collected — including legal, regulatory, and anti-money-laundering obligations. Account data for closed accounts is retained for a minimum of five (5) years from the date of closure in line with financial record-keeping requirements.
Your Rights Are Real and Exercisable
As a ddok account holder, you have the right to access the personal data we hold about you, request corrections to inaccurate data, ask us to delete data where no legal obligation requires its retention, and object to certain processing activities. Submit any such request to [email protected] and we will respond within 30 calendar days.
Important Notice
This Privacy Policy describes how ddok collects, uses, stores, and protects the personal data of players who use the ddok platform at https://ddok.io. By creating a ddok account or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy. This policy should be read alongside the ddok Terms and Conditions.
1 Introduction
ddok ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the ddok platform. This Privacy Policy sets out in clear terms what personal data we collect from players in Bangladesh, the purposes for which we process that data, the legal bases on which processing is carried out, and the rights available to data subjects.
ddok operates the online casino and sports betting platform accessible at https://ddok.io. The platform is designed for players aged 21 and above located in Bangladesh. All personal data collected is processed in connection with the provision of these services.
ddok acts as the data controller in respect of all personal data collected directly through the ddok platform. Where data is processed on ddok's behalf by third-party service providers, those providers act as data processors and are bound by contractual data protection obligations consistent with this policy.
This Privacy Policy was last updated in January 2026. The most current version of this document is always available on this page. If you have any questions about how ddok handles your personal data, please contact us at [email protected] (plain text — not a clickable link).
2 Data We Collect
ddok collects personal data through several channels: directly from you when you register an account, during the KYC identity verification process, when you make deposits or withdrawals, when you interact with customer support, and automatically through your use of the platform. The categories of data collected are described below.
2.1 Registration Data. When you create a ddok account, we collect:
- Full legal name (as it appears on your Bangladeshi National ID card or passport)
- Date of birth (used to verify the 21+ age requirement)
- Mobile phone number registered in Bangladesh
- Email address (if provided)
- Username selected by you for the ddok platform
- Password (stored in hashed, non-reversible form — never stored as plain text)
2.2 Identity Verification Data. As part of our Know Your Customer (KYC) process, we may collect:
- Scanned copy or photograph of your Bangladeshi National ID card (NID), passport, or birth certificate
- Proof of address documentation (utility bill, bank statement, or equivalent)
- Selfie photograph for facial comparison against identity documents
2.3 Financial Transaction Data. When you make deposits or request withdrawals, we collect:
- Mobile wallet numbers associated with bKash, Nagad, Rocket, or Upay accounts
- Bank account details for Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, or other Bangladeshi financial institutions where bank transfer is used
- Transaction reference numbers, amounts in Bangladeshi Taka (৳), dates, and statuses
2.4 Gameplay and Betting Data. The ddok platform automatically records:
- Bets placed, games played, outcomes, and wager amounts
- Session start and end times in Bangladesh Standard Time (BST, UTC+6)
- Bonus claims, wagering progress, and promotional interactions
2.5 Technical and Device Data. Our platform infrastructure automatically collects:
- IP address and approximate geographic location
- Device type, operating system, and browser type and version
- Platform session identifiers and access timestamps
- Pages visited within the ddok platform and interaction patterns
2.6 Communications Data. When you contact ddok support, we retain:
- Content of live chat transcripts and email correspondence
- Dispute submissions and their resolution outcomes
- Responsible gaming tool activation records (deposit limit changes, cooling-off requests, self-exclusion activations)
3 How We Use Your Data
ddok uses the personal data described in Section 2 for the following purposes:
| Purpose | Data Used |
|---|---|
| Account registration and management | Registration data, device data |
| Identity verification (KYC / age check) | Identity verification data, registration data |
| Processing deposits and withdrawals | Financial transaction data, identity verification data |
| Preventing fraud and money laundering | All categories |
| Delivering and improving platform features | Gameplay data, technical data |
| Providing customer support | Communications data, registration data |
| Sending transactional notifications (deposit/withdrawal confirmations) | Registration data (mobile number / email) |
| Sending promotional communications (where consent has been given) | Registration data, gameplay data |
| Enforcing responsible gaming restrictions | Gameplay data, communications data, registration data |
| Meeting legal and regulatory record-keeping obligations | All categories |
ddok does not use personal data for automated decision-making that produces legal or similarly significant effects on players, except in the specific case of automated fraud detection systems which may temporarily flag or suspend accounts pending human review.
4 Legal Basis for Processing
ddok processes personal data only where a valid legal basis exists. The primary legal bases on which ddok relies are:
- Contractual necessity: Processing required to perform the contract with you — including account registration, payment processing, identity verification, and the delivery of betting and gaming services.
- Legal obligation: Processing required to comply with anti-money-laundering obligations, age verification requirements, financial record-keeping mandates, and fraud prevention duties.
- Legitimate interests: Processing carried out in ddok's legitimate interests where those interests are not overridden by your data protection rights — including platform security, fraud detection, responsible gaming enforcement, and product improvement analytics.
- Consent: Processing of your data for marketing communications (promotional SMS, platform notifications about bonuses and offers) where you have given explicit, freely-withdrawn consent at registration or via account settings.
Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, use your account settings or contact [email protected].
5 Data Sharing and Disclosure
5.1 Service Partners. ddok shares personal data with a limited set of third-party service partners who assist in delivering the ddok platform. All such partners are bound by contractual data protection obligations and may use your data only for the purposes specified by ddok. These partners include:
- Payment processors: bKash, Nagad, Rocket, Upay, and Bangladeshi banking partners process financial transaction data to facilitate deposits and withdrawals.
- Identity verification providers: Third-party KYC and document verification services process identity documents and facial comparison data to confirm player identity and age.
- Game studio providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited session and gameplay data necessary to deliver their game content within the ddok platform.
- Fraud and risk analytics providers: Specialist fraud detection platforms receive device fingerprint and transaction pattern data to identify suspicious activity.
- Customer support platforms: Our live chat and ticketing infrastructure providers process communications data in order to deliver support services.
5.2 Law Enforcement and Regulatory Authorities. ddok will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by law or where ddok has a good-faith belief that disclosure is necessary to investigate, prevent, or respond to fraud, money laundering, or other illegal activity involving the platform.
5.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of ddok's business assets, player personal data may be transferred to a successor entity. Players will be notified of any such transfer via the contact details associated with their account prior to the transfer taking effect, and the acquiring entity will be bound by privacy obligations at least as protective as those set out in this policy.
5.4 No Sale of Data. ddok does not sell, rent, or trade your personal data to unaffiliated third-party advertisers, data brokers, or marketing organisations. Any sharing of data is limited to the operational purposes described in this policy.
6 Payment Data
6.1 Processing by Payment Partners. Payment transaction data — including bKash wallet numbers, Nagad account references, and bank account details — is transmitted directly to the relevant payment provider over encrypted connections. ddok does not store full payment credentials on its own servers after the transaction has been processed.
6.2 Transaction Records. ddok retains transaction reference numbers, amounts in Bangladeshi Taka (৳), timestamps, and transaction status records as part of its financial and anti-money-laundering record-keeping obligations. These records are retained for the period specified in Section 8.
6.3 Withdrawal Method Verification. As part of the withdrawal process, ddok verifies that the payment account presented for withdrawal matches the account used for deposits where technically possible. This verification involves comparing wallet numbers or bank account identifiers and constitutes necessary processing under the ddok anti-money-laundering policy.
7 Cookies and Tracking Technologies
7.1 What We Use. The ddok platform uses cookies and similar tracking technologies — including browser-based session tokens, local storage identifiers, and device fingerprinting tools — to support platform functionality, security, and performance analytics.
7.2 Categories of Cookies. The following cookie categories are used on the ddok platform:
- Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security identifiers, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
- Functional cookies: Remember your preferences such as language settings, preferred display options, and responsible gaming tool configurations between sessions.
- Analytics cookies: Collect aggregated, anonymised data about how players use the platform — which pages are visited, how long sessions last, and which features are used most. This data informs product improvements.
- Fraud prevention cookies: Support our fraud detection systems by creating a consistent device fingerprint across sessions to identify anomalous login patterns or account takeover attempts.
7.3 Managing Cookies. You may manage non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair or prevent access to the ddok platform. Disabling analytics or functional cookies will not prevent you from using the platform but may affect your experience. Instructions for managing cookies are available in the help documentation of all major browsers.
8 Data Retention
ddok retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years from closure | Financial record-keeping and AML obligations |
| Identity verification documents | Duration of account + 5 years from closure | KYC regulatory requirements |
| Financial transaction records | 7 years from transaction date | Anti-money-laundering and audit obligations |
| Gameplay and betting history | Duration of account + 2 years from closure | Dispute resolution and responsible gaming monitoring |
| Support communications | 3 years from last interaction | Dispute evidence and service quality review |
| Marketing consent records | Duration of consent + 3 years | Proof of consent for regulatory purposes |
| Technical and device logs | 90 days from collection | Security monitoring and fraud detection |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an individual player. Anonymised aggregated data may be retained indefinitely for statistical and product improvement purposes.
9 Data Security
9.1 Technical Measures. ddok implements the following technical security measures to protect your personal data:
- TLS 1.2 / TLS 1.3 encryption for all data in transit between your device and the ddok platform
- AES-256 encryption for sensitive data fields stored at rest, including identity document references and payment identifiers
- Bcrypt hashing for all stored passwords — passwords are never stored or transmitted in plain text
- OTP-based two-factor authentication available to all account holders
- Automated intrusion detection and rate-limiting controls on login and payment endpoints
- Regular penetration testing and vulnerability assessments of the ddok platform infrastructure
9.2 Organisational Measures. Access to personal data within the ddok organisation is restricted on a need-to-know basis. Staff with access to player data undergo data protection awareness training. Access is logged and audited regularly.
9.3 Data Breach Response. In the event of a personal data breach that poses a risk to players' rights and freedoms, ddok will take immediate containment action and notify affected players without undue delay, providing details of the nature of the breach, the data categories affected, and the steps players should take to protect themselves.
9.4 Player Responsibility. While ddok takes extensive measures to secure your data on the platform side, you are responsible for maintaining the security of your own devices and login credentials. ddok strongly recommends enabling OTP two-factor authentication and avoiding access to the ddok platform over public or shared Wi-Fi networks.
10 Your Rights
As a data subject whose personal data is processed by ddok, you hold the following rights. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". ddok will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.
- Right of access: You may request a copy of all personal data that ddok holds about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared.
- Right to rectification: If any personal data ddok holds about you is inaccurate or incomplete, you may request that it be corrected. ddok will action verified correction requests within 10 business days.
- Right to erasure: You may request deletion of your personal data where ddok no longer has a legal basis or legitimate interest for its continued retention. Note that data subject to financial record-keeping or AML obligations cannot be erased until the applicable retention period has expired.
- Right to restrict processing: You may request that ddok restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being investigated.
- Right to data portability: You may request that ddok provide your personal data in a structured, machine-readable format where processing is based on your consent or on a contractual relationship.
- Right to object: You may object to processing based on ddok's legitimate interests at any time. ddok will cease the relevant processing unless compelling legitimate grounds exist that override your interests.
- Right to withdraw consent: Where processing is based on your consent (primarily marketing communications), you may withdraw consent at any time via account settings or by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
ddok does not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied or the request refused, with written reasons provided.
11 Children and Minors
The ddok platform is strictly intended for individuals aged 21 years and above. ddok does not knowingly collect personal data from individuals under the age of 21. The registration process requires confirmation of date of birth, and ddok conducts documentary age verification as part of its KYC process before processing any withdrawal.
If ddok discovers or receives credible notification that an account belongs to a player under the age of 21, the account will be immediately suspended, all associated personal data will be reviewed, any deposits will be returned to the originating payment method, and all wagers will be voided. The personal data of the minor will be deleted once the account closure process is complete, subject only to any retention obligations imposed by law.
If you have reason to believe that a person under the age of 21 has registered a ddok account, please notify us immediately at [email protected]. ddok treats underage gambling as a serious safeguarding matter and will act on all credible reports without delay.
12 Changes to This Privacy Policy
ddok reserves the right to update or amend this Privacy Policy at any time. When material changes are made — changes that affect how your personal data is collected, used, or shared in ways that may affect your rights — ddok will notify registered players via the mobile number or email address associated with their account no fewer than seven (7) calendar days before the amended policy takes effect.
Non-material changes (such as corrections to typographical errors, clarifications that do not alter the substance of the policy, or updates to reflect new contact details) may be made without advance notice. The effective date shown at the top of this page will always reflect the date of the most recent amendment.
Continued use of the ddok platform following the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the amended policy, you should cease using the platform and contact [email protected] to request account closure and data handling in accordance with your rights under Section 10.
13 Contact and Data Enquiries
For any questions, concerns, or requests relating to this Privacy Policy or to the personal data ddok holds about you, please contact the ddok data team using the details below.
Support and Data Contact: [email protected] (plain text — not a clickable link)
Subject line for data rights requests: "Data Rights Request"
Subject line for data breach reports: "Security / Data Breach"
Support hours: 24 hours a day, 7 days a week. Email responses to data enquiries are provided within 5 Bangladesh business days. Formal data rights requests receive a substantive response within 30 calendar days of receipt.
Responsible Gaming enquiries relating to self-exclusion, deposit limits, or cooling-off periods should be submitted via the account dashboard tools or to [email protected] with the subject line "Responsible Gaming". Please also visit our Responsible Gaming page for full guidance.
This Privacy Policy Is Effective as of January 2026
This document supersedes all previous versions of the ddok Privacy Policy. By continuing to use the ddok platform after this date, you confirm that you have read and understood this policy. For questions about any section of this document, contact [email protected].
Explore ddok With Confidence
Your privacy is protected. Browse our casino games, follow the latest cricket betting markets, or log in to your account — all on a secure, SSL-encrypted platform.