Privacy Policy —
388k Platform

388k is committed to protecting the privacy and personal data of every player who uses the 388k platform. This Privacy Policy sets out in clear and transparent terms the categories of personal data that 388k collects, the purposes for which that data is processed, the parties with whom it may be shared, and the rights that players hold in relation to their personal information.

This Privacy Policy applies to all data processing activities carried out by 388k in connection with the operation of the platform at https://388k.io, including all associated web pages, mobile-optimised interfaces, customer support channels and marketing communications. It applies to all registered players and to any individual who accesses the 388k platform in any capacity, including visitors who have not yet registered an account.

388k operates the platform primarily for players located in Bangladesh. Where this Privacy Policy refers to applicable law, it includes all relevant data protection, privacy, anti-money laundering, and financial services legislation that applies to 388k's operations and to players accessing the platform from Bangladesh.

This Privacy Policy should be read together with the 388k Terms & Conditions, which are incorporated by reference and form part of the overall agreement between 388k and each registered player.

For the purposes of this Privacy Policy, 388k acts as the data controller in respect of all personal data collected and processed in connection with the operation of the 388k platform. As data controller, 388k determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly and transparently.

All enquiries, requests and complaints relating to the processing of personal data by 388k should be directed to our support team at the contact details provided in Section 15 of this Privacy Policy. 388k will acknowledge all data-related communications within 24 hours (Bangladesh Standard Time, BST, UTC+6) and will provide a substantive response within a reasonable period, typically no longer than 30 calendar days from the date of receipt.

388k collects personal data in the following categories. The specific data points collected in each category are described below.

3.1 Registration and Identity Data

• Full legal name as it appears on a government-issued identity document
• Date of birth (required for age verification — players must be 21 years or older)
• Residential address, including district and division (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh)
• Mobile phone number (used for account verification and two-factor authentication)
• Email address (used for account communications and support)
• Username and hashed password (password is never stored in plain text)
• Government-issued photo identification document (NID, passport, or driving licence) — collected at the identity verification stage prior to first withdrawal
• Proof of address documentation where required for enhanced due diligence

3.2 Financial and Transaction Data

• Mobile money account references for bKash, Nagad, Rocket and Upay transactions
• Bank account details where bank transfer channels (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) are used
• Card type and last four digits where Visa or Mastercard is used
• Deposit amounts, withdrawal amounts, dates and transaction reference numbers, all denominated in Bangladeshi Taka (৳)
• Source-of-funds documentation provided in connection with enhanced due diligence reviews

3.3 Platform Usage and Gaming Data

• Betting history: sports markets wagered on, stake amounts, odds accepted, settlement outcomes
• Casino and slot game session data: game titles played, session duration, bet sizes, wins and losses
• Account login timestamps, session duration and logout events
• Responsible gaming tool usage: deposit limits set, session reminders configured, self-exclusion requests submitted
• Bonus and promotion claim history and wagering requirement completion records

3.4 Technical and Device Data

• IP address at time of registration and each subsequent login
• Device type, operating system and browser type and version
• Geolocation data derived from IP address (country and city level only; precise GPS location is not collected)
• Cookie identifiers and similar tracking technologies (see Section 8)
• Page view and navigation data within the 388k platform

3.5 Customer Support Data

• Content of live chat conversations, email correspondence and any other communications submitted to 388k support
• Complaint and dispute records, including details of the issue raised, the investigation conducted and the resolution provided

388k collects personal data through the following means:

Directly from you: The majority of personal data held by 388k is provided directly by you in the course of registering an account, completing identity verification, making deposits or withdrawals, placing bets, contacting customer support, or participating in promotions. You are under no obligation to provide personal data to 388k; however, failure to provide data that is required for account operation, identity verification or payment processing will prevent 388k from delivering the relevant service.

Automatically through the platform: Technical and device data (as described in Section 3.4) is collected automatically when you access and use the 388k platform, through server logs, session tracking systems and cookies. This data is collected regardless of whether you are a registered player or an unregistered visitor to the platform.

From third-party identity verification providers: Where 388k uses a third-party identity verification service to confirm your identity and age, that provider may supply 388k with the result of the verification check and, where applicable, a summary of the documentary evidence reviewed. 388k does not receive copies of your raw identity documents from these providers unless you have separately submitted them directly to 388k.

From payment processors: Payment processors (bKash, Nagad, Rocket, Upay and banking partners) provide transaction confirmation data to 388k to allow deposits to be credited to player accounts and withdrawals to be processed. 388k does not receive your full mobile money PIN, bank account password or card CVV number through this process.

From publicly available sources: In limited circumstances related to fraud prevention and anti-money laundering compliance, 388k may supplement player data with information obtained from publicly available sources such as sanctions lists, politically exposed persons (PEP) databases, and adverse media databases. Such supplemental checks are conducted by authorised compliance personnel only.

388k processes personal data only where there is a valid legal basis for doing so. The following table sets out the primary legal bases relied upon for each category of processing activity:

Where 388k relies on legitimate interest as its legal basis for processing, it has assessed that its legitimate interest is not overridden by the rights and freedoms of the data subjects concerned, taking into account the nature of the data processed and the safeguards in place.

388k uses the personal data it collects for the following purposes:

• Account creation and maintenance: To create, manage and secure your 388k player account, including verifying your identity and age, processing password reset requests, and communicating account-related notices.
• Service delivery: To allow you to place bets on cricket (BPL, IPL, T20 World Cup, Bangladesh Tigers series), access live casino games from Evolution Gaming, Ezugi and other providers, play slots from Pragmatic Play, NetEnt and Microgaming, and use all other products available on the 388k platform.
• Payment processing: To process deposits in Bangladeshi Taka (৳) via bKash, Nagad, Rocket, Upay and banking channels, and to process withdrawal requests to your nominated payment method.
• Identity verification and fraud prevention: To verify that you meet the minimum age requirement of 21 years, to confirm the accuracy of the information you have provided, and to detect, investigate and prevent fraudulent activity, money laundering and other prohibited conduct.
• Responsible gaming: To monitor your gaming activity for indicators of problem gambling, to administer deposit limits, session reminders, cooling-off periods and self-exclusion requests, and to provide appropriate support where concerning patterns of behaviour are identified.
• Customer support: To respond to your enquiries, investigate complaints, resolve disputes and provide technical assistance.
• Legal and regulatory compliance: To fulfil 388k's obligations under applicable anti-money laundering, counter-financing of terrorism, and data protection legislation, including retaining records for the minimum statutory periods and responding to lawful requests from regulatory or law enforcement authorities.
• Platform improvement: To analyse platform usage patterns, identify technical issues, test new features and improve the overall quality of the 388k player experience.
• Marketing: Where you have given your explicit consent, to send you promotional communications about 388k bonuses, tournaments, seasonal promotions (such as Eid, Pohela Boishakh or BPL season offers) and other offers that may be of interest to you. You may withdraw this consent at any time.

388k shares personal data with third parties only in the following circumstances and only to the extent necessary for the specified purpose:

7.1 Payment Processors
Transaction data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card network operators (Visa, Mastercard) as necessary to process your deposit and withdrawal requests. These providers operate under their own privacy policies and applicable financial services regulations. 388k does not share more data with payment processors than is required to complete the specific transaction.

7.2 Identity Verification Partners
Where a third-party identity verification service is used, 388k shares the minimum necessary registration data (name, date of birth, document details) with that provider solely for the purpose of confirming your identity and age. Verification providers are contractually required to process this data only for the specified purpose and to apply appropriate security measures.

7.3 Game Content Providers
When you play a casino or slot game supplied by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe or Ezugi), session data including your anonymised player identifier, stake amounts and game outcomes is shared with the relevant studio for the purpose of operating the game and settling outcomes. These providers do not receive your full name, contact details or payment information.

7.4 Regulatory and Law Enforcement Authorities
388k may be required to disclose personal data to government agencies, regulatory bodies, financial intelligence units or law enforcement authorities where required by applicable law or where 388k reasonably believes disclosure is necessary to protect the legal rights of 388k or its players. Such disclosures will be made in good faith and limited to the data strictly required to satisfy the relevant legal obligation.

7.5 Professional Advisers
388k may share personal data with legal advisers, auditors and compliance consultants where necessary for the conduct of legal proceedings, internal audits or regulatory assessments. Such advisers are bound by professional confidentiality obligations.

7.6 Business Transfers
In the event that 388k undergoes a merger, acquisition, restructuring or sale of all or substantially all of its assets, personal data held by 388k may be transferred to the acquiring or successor entity as part of that transaction. Players will be notified of any such transfer and of any material change to the processing of their personal data that results from it, prior to the transfer taking effect where reasonably practicable.

The 388k platform uses cookies and similar tracking technologies to provide a functional, personalised and secure user experience. A cookie is a small text file stored on your device by your browser when you visit a website. The following categories of cookies are used on the 388k platform:

• Strictly necessary cookies: These cookies are required for the platform to function and cannot be disabled. They include session authentication cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery, and load-balancing cookies that ensure consistent platform performance.
• Functional cookies: These cookies remember your preferences such as display settings, language preferences and responsible gaming tool configurations, so that you do not need to reconfigure them on each visit.
• Analytics cookies: 388k uses anonymised analytics data to understand how players navigate the platform, which pages are most visited, and where technical issues may be occurring. This data is used solely for internal platform improvement purposes and is not shared with third parties for advertising purposes.
• Marketing and attribution cookies: Where you have accessed the 388k platform via a referral link or marketing campaign, attribution cookies may be set to record the source of your visit. This allows 388k to evaluate the effectiveness of its marketing activity. These cookies do not track your activity across third-party websites.

You may configure your browser to block or delete cookies. Please note that disabling strictly necessary cookies will impair the functionality of the 388k platform and may prevent you from logging in or placing bets. Instructions for managing cookies are available in your browser's help documentation.

388k implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. The key security measures in place are described below:

• Transport encryption: All data transmitted between your device and the 388k platform is encrypted using TLS 1.2 or higher (256-bit SSL). The platform enforces HTTPS on all connections and applies HTTP Strict Transport Security (HSTS) headers to prevent protocol downgrade attacks.
• Password security: Player passwords are stored using a one-way cryptographic hashing algorithm with a unique per-account salt. Passwords are never stored in plain text and are never accessible to 388k staff. In the event of a security incident, 388k would be unable to recover your plain-text password — a password reset would be required.
• Two-factor authentication: 388k offers two-factor authentication (2FA) via mobile phone verification. Players are strongly encouraged to enable 2FA to provide an additional layer of protection for their account.
• Login anomaly detection: The 388k platform monitors login events for anomalous patterns, including logins from new devices, unusual geographic locations or repeated failed login attempts. Suspicious login activity triggers additional verification challenges and, where appropriate, account alerts.
• Access controls: Access to personal data within 388k's internal systems is restricted on a need-to-know basis. Staff who handle personal data are subject to confidentiality obligations and receive regular data protection training.
• Payment data security: Sensitive payment data (full card numbers, CVV codes, mobile money PINs) is handled exclusively by certified payment processors and is never transmitted to or stored on 388k servers. 388k stores only non-sensitive payment references required for transaction reconciliation.
• Infrastructure security: The 388k platform is hosted on infrastructure that applies regular security patches, network-level firewalls, and intrusion detection systems. Penetration testing and security reviews are conducted periodically.

Notwithstanding the security measures described above, no digital platform can guarantee absolute security. Players are responsible for maintaining the security of their own login credentials and for notifying 388k immediately at [email protected] if they suspect that their account has been accessed without authorisation.

388k retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any minimum retention periods required by applicable law. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account, from the date of registration until the date of account closure.
• Post-closure retention: Following account closure, 388k retains core identity, transaction and gaming records for a minimum of 5 years. This retention period is required to comply with applicable anti-money laundering legislation, which mandates the retention of customer due diligence and transaction records for a minimum period after the end of the business relationship.
• Customer support records: Retained for a minimum of 3 years following the resolution of the relevant enquiry or complaint, to allow for any follow-up, regulatory audit or legal proceedings.
• Marketing consent records: Retained for as long as you remain opted in to marketing communications, plus a reasonable period after opt-out to demonstrate compliance with consent-based marketing obligations.
• Technical and analytics data: Aggregated and anonymised analytics data may be retained indefinitely. Raw session logs containing personal identifiers are deleted or anonymised after a maximum of 13 months.

At the end of the applicable retention period, personal data is securely deleted from 388k's systems or rendered permanently anonymous in accordance with 388k's internal data retention and disposal procedures. Anonymised data that can no longer be linked to an individual is not subject to this Privacy Policy and may be retained and used for statistical purposes indefinitely.

As a player whose personal data is processed by 388k, you hold the following rights in relation to that data. To exercise any of these rights, please contact 388k at [email protected] with the subject line "Data Rights Request" and a description of your request.

• Right of access: You have the right to request a copy of the personal data that 388k holds about you, together with information about how that data is being processed. 388k will provide this information in a structured, commonly used format within 30 days of receiving a valid request.
• Right to rectification: You have the right to request that 388k corrects any inaccurate or incomplete personal data held about you. Where a correction request relates to identity data, 388k may require documentary evidence to support the requested change.
• Right to erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been processed unlawfully. This right is subject to 388k's legal obligations to retain certain data for minimum statutory periods as described in Section 10.
• Right to restriction of processing: You have the right to request that 388k restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of 388k's legitimate interests.
• Right to data portability: You have the right to receive a copy of personal data that you have provided to 388k in a structured, machine-readable format, and to request that this data be transmitted to another controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where 388k relies on legitimate interest as its legal basis. 388k will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
• Right to withdraw consent: Where 388k processes your personal data on the basis of your consent (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

388k may send you promotional and marketing communications by email or SMS where you have given your explicit consent to receive such communications at the time of registration or subsequently through your account settings. Marketing communications from 388k may include information about deposit bonuses, free bet promotions, seasonal campaigns (such as Eid, Pohela Boishakh, BPL season, IPL season, and T20 World Cup promotions), new game launches, loyalty rewards and other offers.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "unsubscribe" link included in any marketing email sent by 388k
• Updating your communication preferences in your 388k account settings
• Contacting 388k support at [email protected] with a request to be removed from marketing lists

Withdrawal of marketing consent will be processed within 5 business days. Please note that even after withdrawing marketing consent, 388k will continue to send you essential transactional and account communications such as deposit confirmations, withdrawal notifications, identity verification requests, responsible gaming notifications, and updates to the Privacy Policy or Terms & Conditions. These communications are not marketing and cannot be opted out of while your account remains active, as they are necessary for the operation of your account.

388k does not share your contact details with third-party marketing organisations and does not send marketing communications on behalf of third parties.

The 388k platform is strictly for adults aged 21 years and above. 388k does not knowingly collect, process or retain personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration process, and 388k applies further identity document checks prior to processing a player's first withdrawal to confirm that the player meets the minimum age requirement.

If 388k becomes aware that personal data has been collected from an individual who is under the age of 21, it will take immediate steps to close the relevant account, refund any deposits made (less any winnings, which will be forfeited), and permanently delete all personal data associated with that account from its systems.

If you believe that a minor has registered an account on the 388k platform, please notify 388k immediately at [email protected] so that appropriate action can be taken without delay.

388k reserves the right to amend this Privacy Policy at any time. Amendments may be made to reflect changes in applicable law, changes in 388k's data processing practices, the introduction of new products or features, or other operational developments. The current version of this Privacy Policy, together with its effective date, is always available at https://388k.io/privacy-policy.

Where an amendment is material — meaning it significantly affects your rights or the way in which 388k processes your personal data — 388k will provide advance notice of the change by sending an email notification to your registered email address at least 14 days before the amendment takes effect. Your continued use of the 388k platform after the effective date of a material amendment will constitute your acceptance of the revised Privacy Policy.

Where an amendment is non-material — such as a correction of a typographical error, a clarification of existing language, or an update to contact details — 388k may publish the updated Privacy Policy without prior notice. Players are encouraged to review this page periodically to stay informed of any updates.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way in which 388k processes your personal data, please contact our support team using the details below. All privacy-related communications should be submitted in English to ensure prompt and accurate handling.

• Email: [email protected]
• Subject line: "Privacy Enquiry" or "Data Rights Request" as appropriate
• Live Chat: Available 24/7 inside your registered 388k account dashboard
• Support Hours: 24 hours a day, 7 days a week, including Bangladesh public holidays (BST, UTC+6)
• Response Time: Acknowledgement within 24 hours; substantive response within 30 calendar days for data rights requests, and within 5 business days for general privacy enquiries

388k is committed to resolving all privacy-related concerns fairly, transparently and efficiently. If you are not satisfied with the outcome of your complaint after engaging with 388k's internal complaints process, you may seek independent legal advice or pursue any remedies available to you under applicable law in your jurisdiction.