pokok Privacy Policy — How We Protect Your Data

1 Who We Are

pokok operates the online betting and casino platform available at pokok.bar, offering sports betting (including cricket BPL, IPL, T20, and Bangladesh Tigers international fixtures), live casino games, slots, crash games, and related services to adult players aged 21 and above located in Bangladesh.

This Privacy Policy explains how pokok ("we", "us", "our", "the Company") collects, processes, stores, and protects the personal data of registered players and website visitors ("you", "your"). It applies to all interactions with the pokok platform, including the website, any mobile-optimised pages, and all account and transaction services provided therein.

By creating an account on pokok or by continuing to use our platform after this policy has been brought to your attention, you acknowledge that you have read and understood how your personal data is handled as described in this document.

2 Data We Collect

pokok collects the following categories of personal data from players and platform visitors. Collection occurs only where it is necessary for the provision of our services, compliance with legal obligations, or the protection of the Company's legitimate interests.

3 How We Collect Your Data

pokok collects personal data through the following channels:

3.1 Directly From You

The majority of your personal data is collected directly from you during the following interactions with the pokok platform:

• Completing the account registration form on pokok.bar
• Submitting KYC verification documents via our secure upload portal
• Making a deposit or requesting a withdrawal via bKash, Nagad, Rocket, Upay, or bank transfer
• Contacting our customer support team via email or WhatsApp
• Responding to surveys, promotional communications, or feedback requests
• Updating your account profile or notification preferences

3.2 Automatically During Platform Use

When you access and use the pokok platform, certain technical data is collected automatically by our systems. This includes your IP address, browser fingerprint, device identifiers, session timestamps, pages visited, and interaction logs. This data is collected via server logs, cookies, and embedded analytics tools. See Section 7 for full details of our cookie practices.

3.3 From Third Parties

In certain circumstances, pokok may receive personal data about you from trusted third-party sources. These include:

• Payment providers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank) — transaction confirmation and fraud signals
• Identity verification services — confirmation of identity document authenticity
• Fraud prevention partners — risk scoring and device reputation data
• Game providers (Pragmatic Play, Evolution Gaming, Spribe, etc.) — gameplay outcome data for settlement and dispute resolution

In all cases, pokok verifies that any third party sharing data with us has a lawful basis to do so and that the data transfer complies with applicable data protection principles.

4 How We Use Your Data

pokok uses the personal data collected from players and platform visitors for the following specific and legitimate purposes:

• Account Creation and Management: To create, maintain, and administer your registered player account on pokok.bar, including updating your profile and managing account preferences.
• Identity and Age Verification: To verify that you are who you say you are and that you are aged 21 or above, in compliance with our age-restriction policy and applicable regulations.
• Payment Processing: To process your deposits via bKash, Nagad, Rocket, and other accepted payment methods, and to fulfil your withdrawal requests to your registered payment account.
• Service Delivery: To provide you with access to the full range of betting markets, casino games, slots, and crash games available on the pokok platform.
• Customer Support: To respond to your enquiries, complaints, and support requests efficiently and accurately, using the communication history we hold about your account.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited behaviours on our platform.
• Responsible Gaming: To monitor your gameplay patterns for signs of problem gambling and to deliver responsible gaming interventions, deposit limit enforcement, and self-exclusion management where required.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, data retention obligations, and responses to lawful requests from competent authorities.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, usability, and content of the pokok platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and personalised recommendations — but only where you have provided your explicit consent to receive such communications. You may withdraw marketing consent at any time.

5 Legal Basis for Processing

pokok processes your personal data on the basis of one or more of the following legal grounds, depending on the specific processing activity involved:

• Contractual Necessity: Processing is required to perform the contract between you and pokok — i.e., to provide you with the betting and casino services you have registered to use. This covers account management, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering requirements, age verification obligations, and data retention mandates.
• Legitimate Interests: Processing is necessary for pokok's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your privacy rights.
• Consent: For processing activities not covered by the above grounds — specifically, direct marketing communications and the use of non-essential cookies — pokok relies on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Third Parties

6.1 Who We Share Data With

pokok does not sell, rent, or exchange your personal data for commercial gain. We share personal data only with the following categories of recipients, and only to the minimum extent necessary:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — to process deposits and withdrawals on your behalf.
• Identity Verification Partners: Specialist KYC service providers who authenticate identity documents and perform liveness checks to comply with our verification obligations.
• Game Technology Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other game studios — who require player session data to deliver their game content and settle outcomes correctly.
• Fraud and Risk Management Services: Third-party fraud prevention platforms that provide device reputation data and transaction risk scoring to protect the platform and its players.
• Legal and Regulatory Authorities: Competent law enforcement agencies, courts, or regulatory bodies where pokok is legally compelled to disclose player data in response to a lawful order or investigation.
• Professional Advisers: Lawyers, auditors, and accountants who are bound by professional confidentiality obligations and who require access to certain records in the course of providing services to pokok.

6.2 International Transfers

Some of our third-party service providers are based outside Bangladesh. Where personal data is transferred internationally, pokok ensures that adequate safeguards are in place — such as contractual data protection clauses — to protect your information to a standard equivalent to the protections offered within Bangladesh.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such change and of any resulting impact on the processing of your personal data as soon as practicable.

7 Cookies & Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by the pokok website when you visit. They allow the platform to recognise your device, remember your preferences, maintain your login session, and gather analytical data about how the site is used. Cookies do not give pokok access to your device or to any data beyond what the cookie itself contains.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These include session management cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, display options, and recently viewed games to personalise your experience on the platform.
• Analytical Cookies: Collect aggregated, anonymised data about how visitors use the pokok platform — which pages are visited most frequently, where users drop off, and how navigation paths flow. This data is used solely to improve the platform.
• Marketing Cookies: Used only where you have given explicit consent. These cookies track your activity to allow pokok to deliver relevant promotional content. You may withdraw consent for marketing cookies at any time via your account settings.

7.3 Managing Cookies

You can manage or disable non-essential cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the pokok platform — for example, disabling functional cookies may prevent the platform from remembering your preferences between sessions. For full instructions on managing cookies in your specific browser, refer to your browser's help documentation.

8 Data Security

pokok takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or disclosure.

Our security framework includes the following measures:

• SSL/TLS Encryption: All data transmitted between your browser and the pokok platform is encrypted using industry-standard TLS 1.2 or higher protocols, ensuring that data in transit cannot be intercepted by unauthorised parties.
• Encryption at Rest: Sensitive personal data stored on pokok's servers — including identity documents, financial records, and payment credentials — is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data within pokok's internal systems is restricted on a strict need-to-know basis. Staff access rights are reviewed regularly and revoked immediately upon departure or role change.
• Firewall and Intrusion Detection: Our server infrastructure is protected by multi-layer firewalls and real-time intrusion detection and prevention systems that monitor for suspicious activity around the clock.
• Regular Security Audits: pokok undergoes periodic independent security reviews and penetration testing to identify and remediate potential vulnerabilities before they can be exploited.
• Staff Training: All pokok staff who handle personal data receive regular training on data protection obligations, secure data handling practices, and the recognition of social engineering threats.

9 Data Retention

pokok retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention principles apply:

• Active Account Data: Personal data associated with an active player account is retained for the full duration of the account's existence and for a period of five years following permanent account closure.
• Financial Transaction Records: Records of all deposits, withdrawals, bets placed, and winnings paid are retained for a minimum of seven years from the date of the transaction, in accordance with applicable financial record-keeping requirements.
• KYC Verification Documents: Identity documents and verification records are retained for a minimum of five years from the date of last verification or account closure, whichever is later.
• Support Communication Logs: Customer support correspondence is retained for three years from the date of the most recent interaction, to support complaint resolution and dispute management.
• Marketing Consent Records: Records of marketing consent — including the date consent was given and the method by which it was obtained — are retained for the duration of the marketing relationship and for two years following withdrawal of consent.
• Technical and Log Data: Server logs and technical access data are retained for up to 12 months and are then either deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted from pokok's systems or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

10 Your Rights

As a player whose personal data is processed by pokok, you hold the following rights in respect of that data. These rights can be exercised at any time by contacting our support team at [email protected]:

• Right of Access: You have the right to request a copy of all personal data that pokok holds about you. We will respond to access requests within 30 days of receipt.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You can update basic account information directly from within your account dashboard.
• Right to Erasure: In certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies — you have the right to request that we delete your personal data. Note that this right may be limited where we are required to retain the data for legal compliance reasons.
• Right to Restriction of Processing: You have the right to request that we temporarily restrict the processing of your personal data while a dispute about its accuracy or lawful basis is resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. Where the objection relates to direct marketing, we will honour it immediately and without requiring justification.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing the request and will respond within 30 calendar days.

11 Children & Minors

The pokok platform is strictly intended for adults aged 21 and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Our age verification procedures are specifically designed to prevent underage individuals from registering or accessing gambling services on our platform.

If pokok becomes aware that personal data has been collected from a person who is under the age of 21, we will take immediate steps to permanently close the associated account, delete all personal data collected from that individual, and — where required — report the matter to the appropriate authorities.

If you are a parent or guardian and believe that your child has created an account on pokok, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and take action within 24 hours of receiving such a report.

12 Third-Party Links

The pokok platform may contain references to, or contextual mentions of, third-party services such as payment providers (bKash, Nagad, Rocket) and game studios (Pragmatic Play, Evolution Gaming, Spribe). Where such references include links to external websites, please be aware that those websites operate under their own privacy policies, which are entirely independent of this document.

pokok is not responsible for the privacy practices or the content of any third-party website. We encourage you to review the privacy policy of any external service before providing your personal data to that service. The inclusion of a reference to a third-party service on the pokok platform does not constitute an endorsement of that service's privacy practices.

13 Changes to This Privacy Policy

pokok reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the scope of services offered on the platform. All updates are subject to an internal review process before publication.

When a material change is made to this Privacy Policy — that is, any change that meaningfully affects the way we collect, use, share, or retain your personal data — we will take the following steps to ensure you are informed:

• A prominent notice will be displayed on the pokok platform prior to the change taking effect, describing the nature of the update and the date on which it becomes operative.
• A notification will be sent to the email address registered to your player account at least seven days before any material change takes effect, where practicable.
• The "Last Updated" date at the top of this document will be revised to reflect the date on which the updated version was published.

Minor or non-material changes — such as typographical corrections, clarifications that do not alter the substance of existing practices, or formatting updates — may be made without advance notice, although the "Last Updated" date will still be revised accordingly.

Your continued use of the pokok platform after a revised Privacy Policy has taken effect constitutes your acknowledgement of the updated terms. If you do not agree with a change to this Privacy Policy, you should cease using the platform and may request account closure by contacting our support team.

14 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or about the way in which pokok processes your personal data, please do not hesitate to contact our dedicated support team. We are committed to resolving all privacy-related enquiries promptly, fairly, and transparently.

When submitting a privacy-related request or complaint, please include your registered username, the nature of your concern, and any relevant reference numbers or dates to allow us to investigate efficiently.

Email: [email protected]

WhatsApp: +880 1700 000000

Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)