Your Privacy Matters at nepk

Section 1

Introduction & Scope

This Privacy Policy (hereinafter "Policy") describes how nepk (hereinafter "nepk", "we", "us", or "our") collects, uses, stores, shares, and protects personal information in connection with the online betting and casino services available at https://nepk.io and all associated subdomains, mobile-optimised interfaces, and digital touchpoints operated by nepk.

This Policy applies to all individuals who access the nepk platform, whether as registered account holders, prospective players browsing the site without an account, or visitors who interact with nepk through support channels. By using the nepk platform in any capacity, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference into the overall agreement between you and nepk. In the event of any conflict between this Policy and the Terms & Conditions on matters relating to data privacy, this Policy shall prevail.

This Policy is written in English and is intended for players based in Bangladesh. Where Bangladeshi law imposes specific obligations on us regarding the personal data of Bangladeshi residents, we comply with those obligations in full in addition to the standards described in this Policy.

Section 2

Data Controller

nepk is the data controller responsible for your personal information collected through the platform. As data controller, nepk determines the purposes and means by which your personal data is processed. All queries, requests, and complaints relating to the handling of your personal data should be directed to nepk using the contact details provided in Section 16 of this Policy.

Where nepk engages third-party service providers to process personal data on its behalf — including payment processors, identity verification providers, and game studios — those parties act as data processors under contractual arrangements that require them to process your data only on nepk's instructions and to maintain appropriate security and confidentiality standards. nepk retains full data controller responsibility for the processing activities performed by its authorised processors.

Section 3

Data We Collect

nepk collects the following categories of personal data in connection with the provision of its services:

Registration & Identity Data:

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification — players must be 21 or older)
• Residential address including district, city (e.g., Dhaka, Chittagong, Sylhet, Khulna), and postal code
• Email address
• Mobile phone number linked to your preferred payment method
• Username and encrypted password

Identity Verification Data:

• Copies of government-issued photo identification (National Identity Card, passport, or driving licence)
• Proof of payment method ownership (screenshot or statement confirming the bKash, Nagad, Rocket, or Upay account is registered in your name)
• Selfie or live photograph where required for enhanced verification

Financial & Transaction Data:

• Deposit and withdrawal amounts, dates, and transaction reference numbers
• Payment method details (mobile wallet number for bKash, Nagad, Rocket, Upay)
• Account balance history and bonus fund records
• Wagering history, including bet amounts, game selections, and outcomes

Technical & Usage Data:

• IP address and approximate geolocation
• Device type, operating system, browser type and version
• Session duration, pages visited, and navigation patterns
• Game rounds played, including round IDs and timestamps
• Login and logout timestamps

Communication Data:

• Records of live chat conversations with the nepk support team
• Email correspondence sent to or received from [email protected]
• Survey responses and feedback submitted voluntarily
• Records of responsible gaming tool requests (e.g., deposit limit changes, self-exclusion requests)

We do not collect sensitive personal data such as biometric identifiers (other than where a selfie is required for identity verification), racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Where identity verification requires a biometric photograph, that image is processed solely for the purpose of identity confirmation and is not used for any other purpose.

Section 4

How We Collect Data

nepk collects personal data through the following channels:

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or participate in any promotional activity offered by nepk.
• Automatically through the platform: When you access the nepk website or mobile interface, our systems automatically collect technical and usage data including your IP address, device identifiers, browser information, and session activity through cookies and similar tracking technologies. See Section 11 for full details on our use of cookies.
• From payment providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, or Upay, nepk receives transaction confirmation data from those providers necessary to credit or debit your nepk wallet.
• From identity verification providers: Where nepk uses a third-party identity verification service to authenticate documents or verify your age, that provider may supply nepk with a verification result and associated data extracted from your submitted documents.
• From fraud prevention services: nepk may receive data from third-party fraud intelligence providers to assist in the detection of suspicious account activity or attempted platform abuse.

Section 5

How We Use Your Data

nepk uses the personal data it collects for the following purposes:

nepk does not use personal data to make automated decisions that produce significant legal effects on you without human review. Where automated tools are used — for example, in fraud detection or responsible gaming monitoring — any decision to restrict or suspend an account based on automated signals is reviewed by a member of the nepk compliance team before being actioned.

Section 6

Legal Basis for Processing

nepk processes your personal data on the following legal grounds, depending on the nature and purpose of the processing activity:

• Contract performance: Processing necessary to create your account, manage your gameplay, process your transactions, and deliver the services you have requested under the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, age verification requirements, fraud reporting duties, and responses to lawful orders from regulatory authorities or law enforcement agencies.
• Legitimate interests: Processing carried out for nepk's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and the improvement of platform services — provided that these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for purposes that require your opt-in consent, including the sending of personalised marketing communications and the use of non-essential cookies. You may withdraw consent for these activities at any time without affecting the lawfulness of processing already carried out before withdrawal.

Section 7

Sharing Your Data

nepk does not sell your personal data to third parties. We do not share your information with advertisers, data brokers, or marketing networks without your explicit consent. Your data is shared only with the categories of recipients described below, and only to the extent strictly necessary for the purposes outlined in this Policy.

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated.
• Identity verification providers: Third-party KYC and document verification services receive your identity documents and personal details for the purpose of confirming your eligibility to hold a nepk account.
• Game studios and content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session-level data (such as player ID and stake amounts) necessary to deliver game functionality and resolve disputes. These providers do not receive your full personal profile.
• Fraud prevention and security services: nepk uses third-party tools to detect and prevent fraudulent activity. These services may process your IP address, device fingerprint, and transaction patterns.
• Legal and regulatory authorities: Where required by law, court order, or a lawful request from a government or regulatory body, nepk may disclose personal data to the relevant authority. nepk will notify you of any such disclosure where permitted by law to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of nepk's business, personal data held by nepk may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights under this Policy will remain unaffected.

All third parties with whom nepk shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the purposes for which it was shared. nepk does not permit its service providers to use your data for their own marketing or commercial purposes.

Section 8

International Transfers

Some of nepk's service providers and technology partners operate outside of Bangladesh. Where your personal data is transferred to or processed in a country outside Bangladesh, nepk takes steps to ensure that an adequate level of data protection is maintained, including by entering into data processing agreements with those providers that incorporate appropriate contractual safeguards.

nepk will not transfer your personal data to a jurisdiction that does not provide an adequate standard of data protection without first implementing appropriate safeguards. If you would like further information about the specific safeguards applied to any international data transfer, you may contact us at [email protected].

Section 9

Data Retention

nepk retains your personal data for as long as your account remains active and for a period thereafter as required by our legal and regulatory obligations or as necessary to resolve disputes, enforce our agreements, and protect our legitimate interests.

The following retention periods apply as a general guide:

• Account registration data: Retained for the duration of the account relationship plus a minimum of 5 years following account closure, to comply with AML and financial record-keeping obligations.
• Identity verification documents: Retained for a minimum of 5 years following the completion of the verification process or account closure, whichever is later.
• Transaction and financial records: Retained for a minimum of 5 years following the date of the relevant transaction.
• Support and communication records: Retained for 3 years following the close of the relevant support case.
• Technical and usage logs: Retained for up to 12 months in identifiable form; thereafter anonymised for statistical analysis.
• Marketing consent records: Retained for the duration of the consent period plus 2 years following withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that makes it impossible to re-identify you from the remaining data.

Section 10

Security Measures

nepk implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the nepk platform is encrypted using industry-standard SSL/TLS protocols, ensuring that information cannot be intercepted in transit.
• Encrypted data storage: Sensitive data fields — including identity documents and payment credentials — are stored in encrypted form within nepk's secure infrastructure.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. nepk staff members can only access the data necessary to perform their specific role. All access is logged and regularly audited.
• Two-factor authentication: nepk offers two-factor authentication (2FA) on player accounts and requires it internally for staff accessing back-end systems containing personal data.
• Regular security audits: nepk's systems and infrastructure are subject to regular security assessments and penetration testing by qualified security professionals.
• Incident response: nepk maintains a data breach response plan. In the event of a data breach that poses a risk to your rights, nepk will notify affected individuals and, where required, the relevant authorities, within the timeframe required by applicable law.

While nepk takes every reasonable precaution to protect your data, no internet-based system is completely immune to security risks. You are encouraged to use a strong, unique password for your nepk account, to enable 2FA, and to log out of your account when using shared or public devices.

Section 11

Cookies & Tracking Technologies

nepk uses cookies and similar tracking technologies (including browser local storage and session storage) to operate the platform, remember your preferences, analyse usage patterns, and support fraud detection. The following categories of cookies are used on the nepk platform:

• Strictly necessary cookies: These cookies are essential for the platform to function correctly. They enable core features such as user authentication, session management, and security controls. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: These cookies remember your preferences and settings — such as language preferences and display options — to provide a more personalised experience on your return visits.
• Analytics cookies: These cookies help nepk understand how players interact with the platform by collecting aggregated, anonymised usage data. This information is used to identify areas for improvement and to optimise the user experience.
• Security cookies: These cookies assist nepk's fraud detection systems by identifying unusual patterns of behaviour that may indicate unauthorised account access or platform abuse.

Non-essential cookies (functional and analytics) are only placed on your device following your consent. You may withdraw your consent for non-essential cookies at any time by adjusting your browser settings to reject or delete cookies. Please note that disabling certain cookies may affect the functionality of some platform features.

nepk does not use third-party advertising cookies or tracking pixels that share your browsing behaviour with external advertising networks.

Section 12

Your Privacy Rights

As a data subject, you have the following rights in respect of the personal data that nepk holds about you. To exercise any of these rights, please contact us at [email protected] with your full name, registered email address, and a clear description of your request. nepk will respond to all valid requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data nepk holds about you, along with information about how it is being processed.
• Right to rectification: If any personal data nepk holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
• Right to erasure ("right to be forgotten"): You may request that nepk delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. This right is subject to overriding legal retention obligations — for example, financial records required under AML law cannot be deleted on request.
• Right to restrict processing: You may request that nepk restrict the processing of your data in certain circumstances, for example while the accuracy of the data is being contested or while an objection is being assessed.
• Right to data portability: Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, and to opt out of direct marketing communications at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If you are not satisfied with nepk's response to a privacy rights request, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

Section 13

Minors & Age Verification

The nepk platform is strictly intended for adults aged 21 years and above. nepk does not knowingly collect, process, or store personal data relating to persons under the age of 21. Age verification is conducted as part of the account registration and identity verification process, and nepk reserves the right to request documentary proof of age from any player at any time.

If nepk becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately and the associated account will be permanently closed. Any funds deposited by or on behalf of an underage player will be returned to the originating payment method following an investigation, minus any amounts paid out in winnings during the period of underage access.

Parents and guardians in Bangladesh are strongly encouraged to use parental control software and internet filtering tools to prevent minors from accessing online betting and gambling platforms. If you believe a person under 21 has registered or used a nepk account, please notify us immediately at [email protected].

Section 14

Marketing Communications

With your consent, nepk may send you personalised marketing communications about promotions, bonuses, new game releases, seasonal offers (such as Eid promotions, BPL special offers, and T20 World Cup betting markets), and other platform updates. Marketing communications are sent by email to the address registered on your account.

You may opt in to marketing communications during account registration or at any later point via your account settings. You may withdraw your consent and opt out of all marketing communications at any time by clicking the "unsubscribe" link included in every marketing email, or by contacting us directly at [email protected]. Opt-out requests will be processed within 5 business days.

Withdrawing consent for marketing communications will not affect the delivery of transactional communications (such as deposit confirmations, withdrawal notifications, account security alerts, and mandatory regulatory notices), which nepk is required to send regardless of marketing preferences.

nepk does not share your contact details with third-party marketers for their own promotional campaigns. All marketing communications you receive will be from nepk directly.

Section 15

Changes to This Policy

nepk reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. When material changes are made, nepk will notify registered account holders by email to the address on file and will display a prominent notice on the platform for a period of at least 30 days following the update.

The "Last Updated" date at the top of this Policy will always reflect the date on which the most recent version came into effect. We encourage you to review this Policy periodically to stay informed about how nepk protects your personal information. Your continued use of the nepk platform following notification of a material change constitutes your acceptance of the updated Policy.

If you do not agree to the terms of an updated Privacy Policy, you should discontinue use of the platform and contact us at [email protected] to request account closure. nepk will process your account closure request in accordance with the Terms & Conditions and will retain data only to the extent required by applicable retention obligations described in Section 9.

Section 16

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way nepk handles your personal data, please contact us using the details below. Our support team is available 24 hours a day, 7 days a week, and our dedicated compliance team handles all formal privacy requests during business hours (Bangladesh Standard Time, UTC+6).

Email: [email protected]

Response times: Live chat queries are typically answered within 2–5 minutes. Email requests are answered within 4 hours for general support and within 30 days for formal data subject rights requests.

When submitting a privacy rights request, please include your full name, the email address registered to your nepk account, and a clear description of your request or complaint. This will help us locate your records promptly and respond accurately. nepk may need to verify your identity before processing a data access, rectification, or deletion request.

If you have submitted a formal complaint to nepk and are not satisfied with the outcome or the time taken to resolve it, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. nepk will cooperate fully with any investigation conducted by a supervisory authority.