500tk Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") describes how 500tk ("we", "us", "our") collects, uses, stores, and protects the personal information of individuals ("you", "Player", "User") who access or use the 500tk website located at 500tk.io and all associated subdomains, mobile interfaces, APIs, and platform features (collectively, the "500tk Platform" or "Services").

This Policy applies to all personal data processed in connection with your use of the 500tk Platform, whether you are a registered account holder, a visitor browsing the site without an account, or a person who contacts us through our support channels. It covers data collected both automatically (e.g., through cookies and device data) and data you provide directly to us (e.g., during registration or KYC verification).

By accessing the 500tk Platform or registering an account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the 500tk Platform immediately.

2 Data Controller Identity

For the purposes of applicable data protection law, the data controller responsible for your personal information collected through the 500tk Platform is:

• Platform Name: 500tk
• Website: 500tk.io
• Primary Market: Bangladesh
• Contact Email: [email protected]
• Operating Hours: 24/7 support available via in-platform live chat; email responses within 24 hours during Bangladesh Standard Time (BST, UTC+6)

All data rights requests, privacy complaints, and enquiries regarding this Policy should be directed to the contact details listed above and in Section 14 of this document. We are committed to responding to all data-related enquiries within 5 business days.

3 Personal Data We Collect

The following table sets out the categories of personal data that 500tk may collect about you, along with examples of the specific data points within each category:

We do not collect special category (sensitive) personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request — in which case that data is processed solely for the purpose of applying the requested protective measure.

4 How We Collect Your Data

4.1 Data You Provide Directly

The majority of personal data we hold about you is information you have voluntarily provided during specific interactions with the 500tk Platform, including:

• Completing the account registration form (name, date of birth, contact details, chosen username)
• Submitting identity and address documents during KYC verification
• Initiating deposit or withdrawal transactions through the Cashier section
• Contacting our support team via live chat or email
• Participating in promotions, surveys, or competitions hosted on the Platform
• Updating your account profile or communication preferences

4.2 Data Collected Automatically

When you access the 500tk Platform, certain technical data is collected automatically through server logs, cookies, and similar tracking technologies. This includes your IP address, device identifiers, session duration, pages visited, buttons clicked, game sessions initiated, and referral sources. This data is used for platform security, fraud detection, performance analytics, and responsible gaming monitoring. See Section 8 for full details on our use of cookies.

4.3 Data Received from Third Parties

In limited circumstances, we may receive personal data about you from third-party sources, including:

• Payment Providers: Transaction confirmation data (status, amount, wallet reference) from bKash, Nagad, Rocket, Upay, Visa, and Mastercard to reconcile deposits and withdrawals
• Identity Verification Services: Confirmation responses from KYC verification partners when processing document checks
• Fraud Prevention Services: Risk scores or flags from third-party fraud screening services used to protect the integrity of the Platform

5 Legal Basis for Processing

Every data processing activity conducted by 500tk relies on at least one valid legal basis. The primary legal bases we rely on are as follows:

• Contractual Necessity: Processing required to fulfil our obligations to you under the 500tk Terms and Conditions — including account creation, payment processing, and game delivery — is necessary for the performance of our contract with you.
• Legal Obligation: Processing required to comply with applicable Bangladeshi law, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and record-keeping mandates imposed by financial regulations.
• Legitimate Interests: Processing carried out in pursuit of legitimate business interests that do not override your fundamental privacy rights, including fraud prevention, platform security monitoring, responsible gaming analysis, and service improvement analytics.
• Consent: Processing for marketing communications (promotional emails, SMS) relies on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing. See Section 11 for how to exercise this right.

6 How We Use Your Data

500tk processes your personal data for the following specific purposes:

• Account Management: Creating and maintaining your player account, verifying your identity during login, and enabling secure access to all Platform features.
• Payment Processing: Executing deposit and withdrawal transactions, reconciling payment records, and investigating any disputed transactions with your payment provider.
• KYC Compliance: Verifying your identity and age (21+) in accordance with our obligations under applicable Bangladeshi financial regulations and our own responsible gaming commitments.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorised account access, collusion, and any other conduct that may harm players or the integrity of the Platform.
• Responsible Gaming: Monitoring gaming patterns to identify players who may be exhibiting signs of problem gambling behaviour, enabling timely intervention, and facilitating use of self-exclusion, deposit limit, and cool-off tools.
• Customer Support: Responding to your enquiries, complaints, and technical support requests in an accurate and timely manner, with full context of your account history where relevant.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players interact with the Platform, improve game offerings, optimise site performance, and develop new features.
• Legal Compliance: Meeting our obligations under applicable Bangladeshi law, responding to lawful requests from competent authorities, and maintaining records as required by financial and gaming regulations.
• Marketing Communications: Sending you personalised promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. Marketing is always opt-in and never a condition of account registration.

7 Data Sharing & Third Parties

7.1 Categories of Recipients

500tk does not sell your personal data. We share personal data only with the following categories of third parties, and only to the extent strictly necessary for the stated purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard — for the sole purpose of processing your deposit and withdrawal transactions.
• Identity Verification Partners: Third-party KYC verification services that assist in processing identity document checks. These providers act solely as data processors under our instruction and are prohibited from using your data for their own purposes.
• Fraud & Security Services: Specialist fraud detection providers who analyse transaction and behavioural data to identify and prevent financial crime on the Platform.
• Cloud Infrastructure Providers: Hosting and data storage providers on whose infrastructure the 500tk Platform operates. All infrastructure providers are contractually required to maintain the same security standards as 500tk.
• Customer Support Platform: The third-party live chat and ticketing platform used to deliver our 24/7 customer support service.
• Legal and Regulatory Authorities: Competent government authorities, law enforcement agencies, or courts in Bangladesh where we are legally required to disclose personal data in response to a lawful order or to fulfil our regulatory reporting obligations.

7.2 Data Processing Agreements

All third-party service providers who process personal data on behalf of 500tk are bound by written data processing agreements that require them to: process data only on our documented instructions; maintain appropriate technical and organisational security measures; not engage sub-processors without our prior consent; and delete or return all personal data at the end of the engagement.

7.3 International Data Transfers

The 500tk Platform primarily processes and stores data within systems accessible in Bangladesh. Where any personal data is transferred to or processed by systems located outside Bangladesh, 500tk ensures appropriate safeguards are in place, including contractual protections equivalent to those applied to domestic processing. 500tk does not transfer personal data to any country without first assessing the adequacy of data protection standards in that destination.

8 Cookies & Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit the 500tk Platform. They allow the Platform to recognise your device across sessions, maintain your login state, remember your preferences, and gather analytics data about how the Platform is used.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and cookies that maintain your login state. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display options, and responsible gaming limit configurations. Disabling these may affect your experience but will not prevent access to core features.
• Analytics Cookies: Collect anonymised data about how players navigate and use the Platform. Used to improve performance, identify errors, and enhance the overall user experience. No personally identifiable data is shared with analytics providers.
• Security Cookies: Used specifically for fraud detection and account protection, including device fingerprinting to identify unusual login patterns and prevent unauthorised access to player accounts.

8.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, though doing so may impair some Platform functionality. Instructions for managing cookies in major browsers are widely available on the respective browser publishers' support pages. Note that strictly necessary and security cookies cannot be disabled, as they are integral to the safe and functional operation of your 500tk account.

9 Data Retention

500tk retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply to the main categories of data we hold:

Following the expiry of the applicable retention period, personal data is securely and irreversibly deleted from all 500tk systems and backup archives. Where data cannot be immediately deleted due to technical constraints (e.g., backup cycles), it is isolated from active processing until the next scheduled deletion window, which occurs at least quarterly.

10 Data Security

500tk maintains a comprehensive information security programme designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• Encryption in Transit: All data exchanged between your device and the 500tk Platform is encrypted using TLS 1.3 with 256-bit symmetric encryption. Connections using older, insecure protocols are rejected at the server level.
• Encryption at Rest: Personal data and financial records stored on 500tk servers are encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data using a hardware security module (HSM).
• Access Controls: Access to personal data within 500tk systems is governed by role-based access control (RBAC). Staff members can only access data that is necessary for their specific job function. All access is logged and subject to periodic audit.
• Password Security: Account passwords are never stored in plain text. All passwords are hashed using a modern, computationally expensive hashing algorithm (bcrypt) with per-user salting to prevent rainbow table attacks.
• Intrusion Detection: The 500tk Platform is monitored continuously by automated intrusion detection systems (IDS) that alert our security team to any unusual access patterns, potential data exfiltration attempts, or application-layer attacks.
• Penetration Testing: The Platform undergoes periodic penetration testing conducted by independent third-party security professionals to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a personal data breach that poses a risk to players, 500tk will notify affected individuals without undue delay and within 72 hours of becoming aware of the breach, providing details of the data affected, the likely consequences, and the remedial measures taken.

11 Your Privacy Rights

As a player on the 500tk Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details in Section 14. We will respond to all valid requests within 5 business days and complete any required action within 30 calendar days, extendable by a further 30 days in complex cases with prior notice.

• Right of Access: You may request a copy of all personal data we hold about you, together with information about how it is being used, from whom it was collected, and with whom it has been shared. We will provide this in a clear, structured format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update many data points directly through your Account Settings without needing to contact us.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other legal basis applies, or where you object to processing based on legitimate interests and your interests override ours. Note that this right is subject to our legal obligations to retain certain data (see Section 9).
• Right to Data Portability: You may request an export of the personal data you have provided to 500tk in a structured, commonly used, machine-readable format (JSON or CSV), suitable for transfer to another service provider.
• Right to Restrict Processing: In certain circumstances (e.g., while a rectification request is being assessed, or where you contest the legal basis for processing), you may request that 500tk restrict its processing of your data to storage only, pending resolution of the matter.
• Right to Object: You have the right to object to processing based on our legitimate interests, including profiling for responsible gaming purposes. You also have an unconditional right to object to processing for direct marketing purposes, which will be actioned immediately.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via Account Settings > Communication Preferences, or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

12 Children & Minors

The 500tk Platform is strictly for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. Account registration requires confirmation of age at the point of sign-up, and all accounts are subject to age verification as part of the KYC process.

If 500tk becomes aware that personal data has been collected from a person under the age of 21, that data will be immediately and securely deleted, the associated account will be permanently closed, and any funds held in the account will be returned to the deposit source. Parents and guardians are strongly encouraged to use parental control software to prevent minors from accessing online gambling services.

13 Changes to This Policy

500tk reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make a material change — one that meaningfully affects your privacy rights or the way we use your data — we will provide at least 7 calendar days' notice by displaying a prominent notice on the 500tk Platform and, where practicable, by sending a notification to your registered email address or mobile number.

For minor, non-material amendments (such as typographical corrections or clarifications that do not change the substance of how your data is used), changes may take effect immediately upon publication. The "Last Updated" date at the top of this document will always reflect when the most recent amendment was made. We recommend reviewing this Policy periodically to stay informed of how 500tk protects your information.

Continued use of the 500tk Platform following the effective date of any amendment to this Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree with any changes, you must close your account before the changes take effect and cease using the Platform.

14 Contact & Data Requests

For all privacy-related enquiries, data rights requests, or complaints regarding the handling of your personal data, please contact the 500tk Privacy team using the details below. We are committed to resolving all privacy matters promptly and transparently.

• Email: [email protected]
• Subject Line: Please use "Privacy Request – [Your Username]" for all data rights requests to ensure prompt routing to our Privacy team
• Response Time: Initial acknowledgement within 24 hours; full response within 5 business days (Bangladesh Standard Time, UTC+6)
• Live Chat: Available 24/7 through the 500tk Platform for general privacy queries and urgent account security concerns

When submitting a data rights request, please provide your registered username, the email address associated with your account, and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request to ensure we do not disclose or modify data belonging to another individual.

If you are dissatisfied with our handling of your privacy complaint after contacting us directly, you have the right to escalate your concern to the relevant competent authority under applicable Bangladeshi law. 500tk will cooperate fully with any such regulatory enquiry.