ek7 Privacy Policy

1 Information We Collect

1.1 Information You Provide Directly

When you register an account, make a deposit, request a withdrawal, or contact our support team, ek7 collects personal information that you voluntarily supply. This includes:

• Identity data: full legal name, date of birth, gender, and nationality;
• Contact data: email address, mobile phone number, and residential address (city, district, postal code);
• Account credentials: username and encrypted password (we never store passwords in plain text);
• Financial data: bKash account number, Nagad account number, Rocket account number, Upay account number, or other payment method identifiers used for deposits and withdrawals — we do not store full card numbers for Visa or Mastercard transactions;
• Identity verification documents: scanned copies of your National Identity Card (NID), passport, or other government-issued photo ID submitted during the KYC process;
• Support communications: the content of messages, emails, and live chat transcripts exchanged with the ek7 support team.

1.2 Information Collected Automatically

When you access and interact with the ek7 platform, certain technical data is collected automatically by our systems. This includes:

• Device data: device type, operating system, browser type and version, screen resolution, and device language settings;
• Network data: IP address, approximate geographic location derived from IP, internet service provider (ISP), and connection type;
• Usage data: pages visited, features accessed, games played, bet amounts, session duration, click-path data, and timestamps of platform interactions;
• Transaction logs: complete records of all deposit and withdrawal transactions, including amounts in BDT, payment method used, timestamps, and transaction status;
• Cookie and tracking data: data collected via cookies, local storage, and similar technologies as described in Section 4 of this policy.

1.3 Information from Third Parties

ek7 may receive additional information about you from trusted third-party sources, including:

• Payment processors (bKash, Nagad, Rocket, Upay) confirming transaction status and account holder identity;
• Identity verification service providers used to cross-check KYC documents;
• Fraud detection and anti-money laundering (AML) screening services;
• Our game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, and Spribe) who may share aggregated gameplay session data with us for technical and compliance purposes.

2 How We Use Your Data

ek7 processes your personal data for specific, clearly defined purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The table below summarises our key processing activities:

2.1 Marketing Communications

ek7 may send you promotional emails, SMS notifications, and in-platform messages about new games, bonuses, seasonal promotions (including BPL, Eid, and Pohela Boishakh campaigns), and platform updates. You may opt out of marketing communications at any time by updating your notification preferences within your account settings or by contacting [email protected]. Opting out of marketing will not affect essential transactional communications such as deposit confirmations and withdrawal notifications.

2.2 Automated Decision-Making

ek7 uses automated systems for fraud detection, responsible gaming monitoring, and bonus eligibility assessment. These systems may flag accounts for review or apply temporary restrictions without human intervention. Where a significant decision is made about your account based solely on automated processing, you have the right to request human review of that decision by contacting our support team.

3 Sharing Your Information

3.1 Who We Share Data With

ek7 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your information only in the circumstances described below:

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum financial data necessary to process your deposit and withdrawal requests. These providers operate under their own privacy policies and are bound by contractual data protection obligations with ek7.
• KYC and identity verification providers: Third-party identity verification services receive copies of your identity documents and personal details solely for the purpose of verifying your age and identity in compliance with our platform's verification requirements.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive a pseudonymous player identifier and session data to deliver their game content on the ek7 platform. These providers do not receive your full name, contact details, or financial information.
• Fraud and AML screening services: Transaction monitoring services receive financial and device data to assess risk and assist with anti-money laundering compliance.
• Legal and regulatory authorities: ek7 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law or by a valid legal order.
• IT infrastructure and cloud providers: Our hosting, database, and technical infrastructure providers may process your data on our behalf under strict data processing agreements.

3.2 International Data Transfers

Some of the third-party service providers with whom ek7 shares data may be located outside Bangladesh. Where personal data is transferred internationally, ek7 ensures that appropriate safeguards are in place — including contractual data protection clauses — to maintain the same level of data protection that applies within our platform. By using ek7, you consent to these transfers where required for the performance of your account contract.

4 Cookies & Tracking

4.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function correctly, work more efficiently, and to provide analytical and personalisation information to site operators. ek7 uses cookies and similar technologies (including local storage and session storage) across the platform.

4.2 Types of Cookies We Use

4.3 Managing Cookies

You may control or delete cookies through your browser settings at any time. Most modern browsers allow you to block all cookies, accept only first-party cookies, or clear stored cookies on exit. Please note that disabling strictly necessary cookies will prevent you from logging in to your ek7 account and using core platform features. Disabling functional or analytical cookies will not prevent you from accessing the platform but may limit the quality of your experience.

5 Data Retention

5.1 Retention Periods

ek7 retains your personal data only for as long as is necessary for the purposes described in this policy, or as required by applicable law. The following retention guidelines apply:

• Active account data (identity, contact, financial): retained for the lifetime of your active account and for a minimum of 5 years after account closure, in line with anti-money laundering record-keeping requirements;
• Transaction records: retained for a minimum of 7 years from the date of each transaction to satisfy financial compliance obligations;
• KYC documents: retained for a minimum of 5 years after account closure or the last verified transaction, whichever is later;
• Support communications: retained for 3 years from the date of the last communication;
• Analytical and usage data: retained in anonymised or aggregated form for up to 3 years for platform improvement purposes;
• Marketing consent records: retained for the duration of your account and for 2 years after account closure.

5.2 Deletion Requests

Where you request deletion of your personal data under the right to erasure (see Section 7), ek7 will assess the request against our legal retention obligations. Data that is subject to a mandatory retention period under financial, legal, or regulatory requirements cannot be deleted until that period has elapsed, even following a deletion request. Where deletion is possible, ek7 will complete it within 30 days of receiving a valid request.

6 Data Security

6.1 Technical Safeguards

ek7 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption: all data transmitted between your device and the ek7 platform is encrypted using industry-standard SSL/TLS protocols;
• Password hashing: account passwords are stored using a strong cryptographic hashing algorithm and are never stored or transmitted in plain text;
• Two-factor authentication (2FA): players are strongly encouraged to enable SMS-based 2FA for an additional layer of account security;
• Database access controls: access to databases containing personal data is restricted to authorised personnel only, using role-based access control;
• Intrusion detection systems: automated monitoring systems detect and alert on anomalous access patterns that may indicate a security breach;
• Regular security audits: the ek7 platform undergoes periodic security assessments to identify and remediate vulnerabilities.

6.2 Organisational Safeguards

Beyond technical controls, ek7 enforces strict internal data handling policies. Staff with access to personal data are bound by confidentiality obligations. Access to sensitive player data is granted on a need-to-know basis only, and all data access events are logged and auditable. ek7 conducts regular staff training on data protection responsibilities.

6.3 Data Breach Response

In the event of a personal data breach that poses a risk to affected players, ek7 will assess the incident, contain the breach, and notify affected players as promptly as reasonably practicable. Notifications will be sent to the email address registered on your account and will include a description of the breach, the type of data affected, and the steps you should take to protect yourself.

7 Your Privacy Rights

As an ek7 player, you hold a number of rights in relation to the personal data we hold about you. These rights are summarised below. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request" along with sufficient information to verify your identity.

ek7 will respond to all valid privacy rights requests within 30 days of receipt. In cases of complex or multiple requests, we may extend this period by a further 60 days with prior notice. There is no charge for exercising your privacy rights. ek7 reserves the right to decline requests that are manifestly unfounded, excessive, or repetitive.

8 Contact & Data Controller

8.1 Data Controller

ek7 acts as the data controller for all personal data collected from players using the platform at ek7.bio. As data controller, ek7 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

8.2 How to Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the way ek7 handles your personal data, please contact the ek7 privacy team using the details below:

• Email: [email protected] (subject line: "Privacy Policy Enquiry")
• Live Chat: Available 24/7 via the ek7 platform support widget
• Response Time: ek7 aims to acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within 30 days.

8.3 Policy Updates

ek7 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. Where changes are material, we will notify registered players by email or via a prominent notice on the platform before the updated policy takes effect. The "Last Updated" date at the top of this document will always reflect the most recent revision. Continued use of the ek7 platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.