Privacy Policy — 22ok Online Casino

About This Privacy Policy

This Privacy Policy ("Policy") is published by 22ok ("22ok", "We", "Us", "Our") and applies to all individuals who visit, register on, or otherwise interact with the 22ok platform at 22ok.online ("Platform"). It describes our practices regarding the collection, use, storage, sharing, and protection of personal data.

22ok operates as an online casino and sports betting platform primarily serving players in Bangladesh. We are committed to handling personal data with integrity, transparency, and in accordance with internationally recognised data protection principles. This Policy has been written in plain English to ensure that every player can understand what happens to their information.

This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy, both of which are published on the 22ok platform. Together, these documents form the complete agreement governing your use of 22ok services.

This Policy was last reviewed and updated on 1 January 2026. The effective date is shown at the top of this document. We will notify registered users of any material changes to this Policy via email or a prominent notice on the platform.

Personal Data We Collect

22ok collects personal data in several categories depending on your relationship with the platform. The table below summarises the types of data we collect and the primary purpose of each category.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information unless this is specifically required for age or identity verification under applicable regulations, and only with your explicit consent.

How We Collect Your Data

22ok collects personal data through the following channels and methods:

• Direct Submission: Data you provide when creating a 22ok account, completing identity verification, contacting our support team via live chat or email, submitting a responsible gaming request, or participating in a promotion.
• Transactional Records: Data generated automatically when you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard. This includes transaction reference numbers, timestamps, and amounts.
• Platform Interaction: Data collected automatically as you navigate the 22ok website, including pages visited, games launched, time spent on each section, and device information. This data is collected via server logs and first-party analytics tools.
• Cookies and Similar Technologies: 22ok uses session cookies, preference cookies, and analytics cookies as described in Section 7 of this Policy. These are set automatically when you visit the platform.
• Third-Party Game Providers: When you play games powered by providers such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, or Microgaming, limited technical and gameplay data may be shared with those providers as required to deliver the game service. See Section 6 for details.
• Payment Processors: When you initiate a transaction, your payment provider (bKash, Nagad, Rocket, Upay, etc.) shares confirmation data with 22ok to verify that the transaction has been completed successfully.
• Identity Verification Providers: If you are required to complete enhanced identity verification, we may use a third-party verification service to cross-check the documents you provide against relevant records.

How We Use Your Personal Data

22ok uses the personal data we collect for the following specific purposes:

• Account Creation and Management: To register your account, verify your identity and age, maintain your account record, and provide you with access to 22ok services.
• Transaction Processing: To process your deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, and to maintain accurate financial records of all activity associated with your account.
• Customer Support: To respond to your enquiries via live chat or email, to resolve complaints and disputes, and to provide technical assistance. All support communications are logged for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling behaviour, to implement the deposit limits, session time reminders, loss limits, cooling-off periods, and self-exclusion requests that you have requested, and to comply with our responsible gaming obligations.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, money laundering, multiple-account abuse, bot activity, and other prohibited conduct described in our Terms & Conditions.
• Legal and Regulatory Compliance: To satisfy anti-money laundering (AML) obligations, record-keeping requirements, and any other applicable legal obligations. This may include retaining transaction and identity records for defined statutory periods.
• Platform Improvement and Analytics: To analyse aggregate usage patterns, identify technical issues, optimise platform performance, and develop new features. Analytics data is processed in aggregate form wherever possible.
• Promotions and Bonuses: To verify your eligibility for promotions, to credit bonus amounts to your account, and to communicate relevant promotional offers to you via email or in-platform notifications, subject to your communication preferences.
• Personalisation: To remember your preferences, display relevant game recommendations, and tailor the platform experience to your usage patterns and stated preferences.

22ok does not use your personal data for automated decision-making that produces significant legal effects without human review, nor do we use your data to build profiles for sale to third-party advertisers.

Legal Basis for Processing Personal Data

22ok processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and 22ok — specifically, to provide account services, process transactions, and deliver the gaming services you have requested. Without this processing, 22ok cannot deliver its services to you.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money laundering regulations, identity verification obligations, and record-retention mandates.
• Legitimate Interests: Processing carried out in pursuit of 22ok's legitimate business interests, provided that those interests are not overridden by your rights and interests. This includes fraud prevention, platform security, responsible gaming monitoring, and internal analytics. We conduct a proportionality assessment before relying on this ground.
• Consent: Where we rely on your consent to process data — for example, for non-essential cookies or for sending certain marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. Consent withdrawals can be submitted to [email protected].

Sharing Your Personal Data

22ok does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your data with the following categories of third parties, strictly on a need-to-know basis and only to the extent required to deliver services or comply with legal obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard — to process your deposit and withdrawal transactions. Each provider operates under its own privacy policy and security standards.
• Identity Verification Providers: Third-party KYC and AML screening services used to verify your identity documents and to conduct mandatory due-diligence checks. These providers process your data solely on our behalf under contractual data processing agreements.
• Game Providers and Studios: Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, Microgaming, and other licensed game studios whose content is hosted on the 22ok platform. When you launch a game, limited data (such as a session token and account identifier) is shared to facilitate gameplay and record game outcomes. Game providers do not receive your full identity or financial data.
• IT Infrastructure and Hosting Providers: Cloud hosting and server infrastructure providers used by 22ok to operate the platform. These providers store data on 22ok's behalf under strict data processing agreements and do not independently access or process your data.
• Legal and Regulatory Authorities: 22ok may be legally required to disclose personal data to law enforcement agencies, courts, or regulatory bodies in response to valid legal process, court orders, or regulatory investigations. We will notify you of such disclosures where legally permitted to do so.
• Professional Advisers: Lawyers, accountants, and auditors who are bound by professional confidentiality obligations, where disclosure is necessary for legal, compliance, or financial reporting purposes.

All third parties with whom 22ok shares personal data are required to implement appropriate security measures and to process that data only in accordance with our written instructions. 22ok remains responsible for ensuring that any third-party processing of your data complies with the principles set out in this Policy.

Cookies & Tracking Technologies

22ok uses cookies and similar technologies — including local storage and session storage — to operate and improve the platform. A cookie is a small text file placed on your device by a website server. Cookies allow the platform to recognise your device across page loads and sessions.

The following categories of cookies are used on the 22ok platform:

• Strictly Necessary Cookies: Essential for the platform to function. These include session cookies that maintain your logged-in state, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cookies cannot be disabled without impairing core platform functionality.
• Functional / Preference Cookies: Store your preferences such as display settings, responsible gaming limit configurations, and notification preferences. These cookies improve your experience but are not essential. You may disable them without losing access to core services.
• Analytics Cookies: Used by 22ok's internal analytics systems to measure aggregate platform usage, identify popular games and features, and diagnose technical problems. Analytics data is processed in aggregate and anonymised form. 22ok does not use Google Analytics or any third-party analytics service that tracks users across external websites.

22ok does not use advertising cookies, retargeting cookies, or any tracking technology that monitors your behaviour on other websites. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from logging in or accessing certain platform features.

Data Retention

22ok retains personal data for the minimum period necessary to fulfil the purpose for which it was collected and to comply with applicable legal, regulatory, and record-keeping obligations. The following retention periods apply as general guidelines:

• Active Account Data: Retained for the full duration of your account's active status, plus the applicable post-closure period described below.
• Closed Account Data: Following account closure, identity records, transaction histories, and KYC documentation are retained for a minimum of five (5) years to satisfy anti-money laundering record-keeping requirements. After this period, data is securely and irreversibly deleted or anonymised.
• Support Communications: Live chat transcripts and email correspondence with the 22ok support team are retained for a period of three (3) years from the date of the communication, or until the associated dispute or complaint is fully resolved, whichever is later.
• Financial Transaction Records: Records of all deposits, withdrawals, and wager settlements are retained for a minimum of five (5) years in accordance with financial record-keeping standards.
• Technical and Log Data: Server logs and device/session data are retained for a maximum of twelve (12) months for security and fraud-investigation purposes, after which they are deleted or anonymised.
• Marketing Preference Data: Retained until you withdraw consent or request removal, plus a further period of one (1) year to maintain a record of your preference history.

When a retention period expires, data is deleted using secure deletion methods that prevent recovery. Where complete deletion is not technically feasible (for example, in backup systems), data is isolated from active processing systems until it can be permanently deleted in accordance with our backup rotation schedule.

Data Security

22ok implements a layered security architecture designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Transport Layer Security: All data transmitted between your browser or device and the 22ok platform is encrypted using TLS 1.2 or higher, providing 256-bit encryption of data in transit.
• Data-at-Rest Encryption: Sensitive personal data and financial records stored in 22ok's databases are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within the 22ok organisation is restricted to employees and contractors who have a documented need to access that data to perform their job functions. Access is controlled through role-based permissions and is subject to regular review and audit.
• Multi-Factor Authentication: Administrative access to systems that store or process personal data requires multi-factor authentication. Employees are required to use strong, unique credentials managed through an approved credential management system.
• Penetration Testing and Vulnerability Assessments: 22ok conducts regular security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: 22ok maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to affected individuals, we will take immediate steps to contain the breach, assess the impact, and notify affected users within a reasonable timeframe.

While 22ok takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. You also play a role in keeping your account secure — please use a strong, unique password and do not share your login credentials with anyone. 22ok support staff will never ask for your password.

Your Data Rights

As a user of the 22ok platform, you hold a defined set of rights in relation to your personal data. These rights can be exercised by contacting our support team at [email protected]. We will acknowledge all data rights requests within five (5) business days and aim to fulfil them within thirty (30) calendar days.

• Right of Access: You may request a copy of all personal data that 22ok currently holds about you, including information about the categories of data held, the purposes for which it is processed, and any third parties with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. Note that this right is subject to limitations where 22ok is required to retain data by law (for example, AML record-keeping obligations).
• Right to Restriction of Processing: You may request that 22ok restricts the processing of your data in certain circumstances — for example, while the accuracy of the data is being contested, or while a legitimate-interests assessment is under review.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests. 22ok will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

22ok will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, providing written reasons for our decision. All requests are handled confidentially by our data protection team.

Children & Protection of Minors

22ok operates a strict minimum age policy and employs age verification procedures at the point of registration and during ongoing account management. If we discover or have reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will:

• Immediately suspend the associated account pending investigation.
• Delete all personal data associated with the underage individual as soon as technically and legally possible, subject to any overriding legal obligations.
• Void and reverse any transactions associated with the account, in accordance with our underage gambling policy.

If you are a parent or guardian and believe that your child has registered an account on 22ok or provided personal data to the platform without your knowledge, please contact us immediately at [email protected] and we will investigate and take appropriate action promptly.

International Data Transfers

22ok's primary platform infrastructure is configured to serve players in Bangladesh and across Asia. However, some of the third-party service providers we use — including game studios such as Pragmatic Play, Evolution Gaming, and Ezugi — operate infrastructure in multiple international locations. As a result, personal data processed in connection with game delivery may be transferred to and processed in countries outside Bangladesh.

Where personal data is transferred internationally, 22ok takes reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy. These safeguards may include:

• Contractual clauses in data processing agreements with third-party providers that impose data protection standards consistent with this Policy.
• Limiting the scope of data transferred to the minimum necessary to deliver the requested service (for example, sharing only session tokens with game providers rather than full identity data).
• Conducting due-diligence assessments of third-party providers' security and data protection practices before engagement.

By using the 22ok platform, you acknowledge that your data may be transferred internationally in the limited circumstances described above, and that 22ok will take all reasonable steps to protect it throughout such transfers.

Updates to This Privacy Policy

22ok reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable laws, platform features, or third-party service providers. When we make material changes to this Policy, we will take reasonable steps to notify registered users. Notification methods may include:

• An email notification to the registered email address on file, summarising the key changes.
• A prominent notice displayed on the 22ok platform homepage or upon next login, highlighting what has changed and when the updated Policy takes effect.
• An updated "Last Reviewed" date at the top of this document.

Your continued use of the 22ok platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes, you should discontinue use of the platform and may request account closure by contacting our support team. We encourage you to review this Policy periodically to stay informed about how 22ok protects your personal data.

Minor updates — such as correcting typographical errors, clarifying existing language without changing the substance of the Policy, or updating contact details — may be made without advance notice, though the "Last Reviewed" date will always reflect the most recent revision.

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 22ok handles your personal data, please contact our data protection team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Response Time: We aim to acknowledge all privacy enquiries within five (5) business days and to provide a full response within thirty (30) calendar days.
• Live Chat: Our support team is available via the platform's live chat feature 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6).
• Subject Line: Please include "Privacy Policy Enquiry" or "Data Rights Request" in the subject line of any email so that it is routed to the correct team without delay.

If you are not satisfied with 22ok's response to a privacy concern or data rights request, you have the right to escalate your complaint. We take all unresolved privacy complaints seriously and will work in good faith to reach a satisfactory resolution. Persistent unresolved complaints may be escalated to the appropriate data protection authority with jurisdiction over 22ok's operations.

22ok values the trust that players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all of Bangladesh place in our platform. Protecting that trust through responsible, transparent data practices is a fundamental commitment — not merely a legal obligation.