Your Privacy Matters to nupk

Section 1

Introduction & Scope

This Privacy Policy ("Policy") is published by nupk, the operator of the online casino and sports betting platform accessible at nupk.io ("Platform"). This Policy explains how nupk collects, uses, stores, discloses, and protects personal data relating to individuals who visit, register on, or otherwise interact with the Platform ("Players").

This Policy applies to all personal data collected through the Platform, including data collected during the account registration process, during identity verification (KYC), during the course of your use of the Platform's games and betting services, through communications you initiate with our support team, and through the use of cookies and similar technologies on our website.

By registering an Account on the Platform, by depositing funds, or by otherwise using the Platform in any capacity, you acknowledge that you have read and understood this Policy and that you consent to the collection, processing, and use of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy should be read alongside the nupk Terms & Conditions, which govern the contractual relationship between you and nupk, and the nupk Responsible Gaming Policy, both of which are accessible from the footer of every page on nupk.io. In the event of any conflict between this Policy and the Terms & Conditions with respect to the handling of personal data, this Policy shall take precedence.

nupk may update this Policy from time to time. The current effective version is always published at nupk.io/privacy-policy, and the effective date is displayed at the top of this page. Material changes will be communicated to registered Players by email notification.

Section 2

Personal Data We Collect

nupk collects personal data in several ways: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and from trusted third-party service providers where necessary to verify your identity or process your payments. The categories of personal data we collect are set out below.

2.1 Registration & Account Data

When you create a nupk Account, we collect the following information:

• Full legal name;
• Date of birth (for age verification — you must be 21 or older);
• Email address;
• Mobile phone number (including country code for Bangladesh, +880);
• Username and password (password stored in hashed form only — never in plain text);
• Residential address (district, city, and postal code within Bangladesh).

2.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering obligations and to protect the integrity of the Platform, we may collect:

• Government-issued photo identification (National ID card, passport, or driving licence);
• Proof of address documentation (utility bill, bank statement, or official government correspondence);
• Proof of payment method ownership (bKash, Nagad, Rocket, or bank account documentation);
• Selfie photographs or video verification where enhanced identity checks are required.

2.3 Financial & Transaction Data

• Deposit amounts, dates, and payment method identifiers (e.g., bKash account number, Nagad wallet reference);
• Withdrawal requests, amounts, and destination payment method details;
• Transaction history including game session stakes, wins, and losses;
• Bonus credits applied to your account and associated wagering activity.

2.4 Technical & Usage Data

When you access the Platform, our servers automatically collect:

• IP address and approximate geographic location (used for security and fraud prevention);
• Device type, operating system, and browser version;
• Pages visited, time spent on each page, and navigation path through the Platform;
• Game sessions accessed, including game titles, session duration, and betting activity;
• Session identifiers and authentication tokens;
• Referring URL (the page or link from which you arrived at nupk.io).

2.5 Communications Data

• Contents of live chat conversations with our support team;
• Email correspondence sent to or received from [email protected];
• Any other written communications you send to nupk.

Section 3

How We Use Your Personal Data

nupk uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the purpose for which it was originally collected without first obtaining your consent or establishing a separate legal basis.

nupk will not use your personal data for automated decision-making that produces legally significant effects without providing you with the opportunity to seek a human review of that decision.

Section 4

Legal Basis for Processing Your Data

nupk processes your personal data on the following legal bases, depending on the purpose of the processing in question:

• Contractual necessity: Processing that is necessary to perform the contract between you and nupk — including account registration, payment processing, delivering gaming services, and customer support — is carried out because it is necessary to fulfil the obligations nupk has to you under its Terms & Conditions.
• Legal obligation: Processing necessary for compliance with applicable legal obligations — including identity verification, anti-money-laundering checks, age verification, and record-keeping obligations — is carried out because nupk is required to do so by law.
• Legitimate interests: Processing carried out to detect and prevent fraud, ensure platform security, improve our services, and monitor for problem gambling behaviour is conducted on the basis of nupk's legitimate interests, provided those interests are not overridden by your rights and interests.
• Consent: Processing of your data for marketing communications — including promotional emails, SMS notifications, and bonus offers — is carried out only where you have given your explicit consent. You may withdraw this consent at any time by contacting our support team or by using the unsubscribe option in any marketing communication.

Section 5

Cookies & Tracking Technologies

nupk uses cookies and similar tracking technologies (such as web beacons and local storage objects) on the nupk.io platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies allow the Platform to recognise your device and remember certain information about your visit.

The following categories of cookies are used on nupk.io:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable core features such as session management, user authentication, and security. The Platform cannot function correctly without these cookies and they cannot be disabled.
• Functional cookies: These cookies allow the Platform to remember your preferences — such as your display language, preferred game categories, and UI settings — so that your experience is personalised across sessions.
• Performance and analytics cookies: These cookies collect aggregated, anonymised information about how players navigate the Platform, which pages are most frequently visited, and where errors occur. This data is used solely to improve the Platform's performance and user experience.
• Security cookies: These cookies are used to detect fraudulent activity, manage session integrity, and prevent cross-site request forgery (CSRF) attacks.

nupk does not use third-party advertising cookies, cross-site tracking cookies, or cookies that build behavioural profiles for sale to third-party advertisers. All cookies set on nupk.io are either first-party cookies (set directly by nupk) or cookies set by essential third-party service providers under contractual data processing agreements.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing your Account or placing bets.

Section 6

Data Sharing & Disclosure

nupk does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly to the extent necessary and in accordance with applicable data protection principles:

• Payment processors: We share necessary transaction and identity data with payment service providers — including bKash, Nagad, Rocket, Upay, and partner banks such as Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank — to process your deposits and withdrawals. These providers operate under their own privacy policies and are bound by confidentiality obligations.
• Identity verification providers: Where third-party KYC verification services are used to validate identity documents and conduct AML screening, your KYC data will be shared with those providers under strict data processing agreements.
• Game technology providers: To deliver game content on the Platform, we work with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. Session data may be shared with these providers to the extent necessary for the delivery and integrity of their games.
• Fraud prevention and security services: We may share device fingerprint data, IP addresses, and behavioural data with specialist fraud prevention partners to detect and prevent fraudulent activity on the Platform.
• Legal and regulatory authorities: nupk will disclose personal data to law enforcement agencies, regulatory authorities, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of nupk, its players, or the public.
• Business successors: In the event of a merger, acquisition, or sale of all or part of nupk's business, personal data held by nupk may be transferred to the relevant successor entity, subject to equivalent privacy protections being maintained.

In all cases where personal data is shared with a third party, nupk ensures that appropriate contractual safeguards — including data processing agreements and confidentiality provisions — are in place before any data is transferred.

Section 7

Data Retention

nupk retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account data: Retained for the duration of your active Account, plus a minimum of five (5) years following Account closure, to comply with anti-money-laundering record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years following the completion of the verification process, or five (5) years following Account closure, whichever is later.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, in accordance with financial record-keeping requirements.
• Communications data (support interactions): Retained for up to three (3) years following the closure of the relevant support interaction, or longer if the communication relates to an unresolved dispute or legal proceeding.
• Technical and usage data: Typically retained for up to twelve (12) months in identifiable form, after which it may be aggregated and anonymised for analytical purposes with no retention limit.
• Marketing consent records: Retained for as long as your marketing consent remains active, plus a reasonable period thereafter to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with nupk's data destruction procedures. Where data is subject to a legal hold — for example, as a result of an ongoing investigation or litigation — the data will be retained until the hold is lifted, after which normal retention and deletion procedures will apply.

Section 8

Data Security

nupk takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to, the following:

• Encryption in transit: All data transmitted between your browser or device and the nupk.io platform is protected using TLS 1.2 or higher encryption. Our HTTPS certificate is continuously maintained and monitored.
• Encryption at rest: Sensitive personal data stored in nupk's databases — including KYC documents, payment identifiers, and contact details — is encrypted using AES-256 encryption at rest.
• Password hashing: Account passwords are never stored in plain text. nupk uses a cryptographic hashing algorithm with per-user salt to store password credentials securely.
• Access controls: Access to systems containing personal data is restricted to authorised nupk personnel on a strict need-to-know basis. All staff access is authenticated, logged, and subject to regular audit.
• Penetration testing: nupk's platform and infrastructure are subject to periodic independent security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident response: nupk maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your personal data, nupk will take immediate remedial action and notify affected players in accordance with applicable legal requirements.
• Fraud monitoring: Automated systems continuously monitor Account activity for indicators of fraudulent behaviour, including suspicious login patterns, unusual transaction volumes, and device anomalies.

While nupk takes every reasonable precaution to protect your personal data, no system is completely immune to security risks. You play an important role in keeping your Account secure by using a strong, unique password, enabling any two-factor authentication options available, and reporting any suspected unauthorised access to [email protected] immediately.

Section 9

Your Data Rights

As a player on the nupk Platform, you have the following rights with respect to the personal data nupk holds about you. These rights may be exercised at any time by contacting our support team at [email protected] with the subject line "Data Rights Request":

• Right of access: You have the right to request a copy of the personal data nupk holds about you. We will provide this information in a clear, structured format within a reasonable timeframe following verification of your identity.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain details directly through your Account dashboard; for other corrections, please contact our support team.
• Right to erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (in cases where consent is the legal basis for processing). This right is subject to nupk's legal obligations to retain certain data — for example, KYC and financial records that must be retained under anti-money-laundering rules cannot be deleted early on request.
• Right to restrict processing: You have the right to request that nupk restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing and a determination is pending.
• Right to data portability: Where processing is carried out on the basis of your consent or on the basis of a contract, and the processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing of your personal data that is carried out on the basis of legitimate interests, including profiling based on legitimate interests. You also have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

nupk will respond to all data rights requests within a reasonable period and will verify your identity before acting on any request. If you are not satisfied with our response, you have the right to escalate your complaint through appropriate channels under applicable law.

Section 10

Children's Privacy

The nupk Platform is strictly intended for adults aged 21 years and above. nupk does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the nupk registration process, and we reserve the right to request documentary proof of age at any time.

If nupk becomes aware that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data, close the associated Account, and return any funds deposited in accordance with our standard closure procedures.

If you are a parent or guardian and you believe that your child may have registered an Account on the nupk Platform, please contact us immediately at [email protected]. We will investigate the matter promptly and take appropriate action.

nupk strongly supports responsible gaming and the protection of vulnerable individuals. For further information about our approach to player protection, please visit our Responsible Gaming page.

Section 11

International Data Transfers

The nupk Platform is operated primarily for players based in Bangladesh. However, in the course of providing our services, your personal data may be processed by systems or personnel located outside of Bangladesh — for example, where our game technology providers, payment processors, or cloud infrastructure partners operate data centres in other countries.

Whenever personal data is transferred outside of Bangladesh, nupk takes steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy. These safeguards may include contractual data processing agreements that impose data protection obligations on the recipient equivalent to those applicable in Bangladesh, or the use of service providers that maintain internationally recognised data security certifications.

By using the nupk Platform and accepting this Policy, you acknowledge and consent to the transfer of your personal data to countries outside of Bangladesh where such transfers are necessary for the provision of the services described in this Policy.

Section 12

Third-Party Links

The nupk Platform may, from time to time, contain references to or integrations with third-party services — for example, game content delivered by licensed game studios, or payment interfaces operated by bKash, Nagad, or Rocket. While nupk exercises care in selecting its third-party service partners, we are not responsible for the privacy practices or the content of any third-party platform or service.

When you interact with a third-party service integrated into the nupk Platform — such as a payment gateway or a live casino feed operated by an external provider — that interaction is governed by the privacy policy and terms of the relevant third party, not by this Policy. We encourage you to review the privacy policies of any third-party services with which you interact.

nupk does not include unsolicited external links in its platform content. The only links on nupk.io lead to other sections of the nupk platform itself or to integrated service interfaces that are necessary for the provision of our services.

Section 13

Marketing Communications

With your consent, nupk may send you marketing communications about promotions, bonuses, new game releases, seasonal offers (such as Eid and Pohela Boishakh specials), and other nupk news via email or SMS to your registered mobile number. Marketing communications are sent in English.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email you receive from nupk;
• Replying "STOP" to any marketing SMS;
• Updating your communication preferences in your Account dashboard;
• Contacting our support team at [email protected] and requesting removal from our marketing list.

Opting out of marketing communications will not affect your ability to receive transactional communications from nupk — such as deposit confirmations, withdrawal notifications, account security alerts, and updates to this Policy — which are sent on the basis of contractual necessity and cannot be unsubscribed from while your Account remains active.

nupk will never send unsolicited marketing communications to individuals who have not consented to receive them, and we will never share your contact details with third-party marketers.

Section 14

Changes to This Privacy Policy

nupk reserves the right to update or amend this Privacy Policy at any time. When we make changes, we will revise the "Last Updated" date displayed at the top of this page. Where changes are material — for example, where we introduce a new category of data processing, a new category of data recipient, or a change to the legal basis for processing — we will provide advance notice by posting a prominent notice on the Platform and by sending an email notification to the address registered on your Account.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes and, where applicable, your consent to the updated data processing practices described therein. If you do not agree to a material change to this Policy, you should cease using the Platform and may request the closure of your Account by contacting [email protected].

We recommend that you review this Privacy Policy periodically — at least once every three months — to remain informed about how nupk is protecting your personal data. The current version of this Policy is always available at nupk.io/privacy-policy.

Section 15

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way nupk handles your personal data, please contact our Data Support team through any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, directly on the nupk.io platform
• WhatsApp: +880 1700-000000 (WhatsApp message only — plain text, not a clickable link)

Our support team operates in Bangladesh Standard Time (BST, UTC+6). We endeavour to acknowledge all data-related enquiries within 48 hours and to resolve them fully within a reasonable period, depending on the complexity of the request.

For formal data rights requests — including subject access requests, erasure requests, and portability requests — please email [email protected] with the subject line "Data Rights Request" and include your registered email address, Account username, and a description of your request. We will verify your identity before acting on any request.