pkko Privacy Policy — How We Protect and Handle Your Personal Data

This Privacy Policy ("Policy") is issued by pkko ("we", "us", or "our") and applies to all personal data processed in connection with the pkko online betting and gaming platform accessible at pkko.im (the "Platform"). This Policy covers all registered account holders, visitors, and any other individuals whose personal data pkko processes in the course of operating the Platform.

pkko is committed to handling personal data responsibly, transparently, and in accordance with recognised data protection principles. Our approach to privacy is built on four pillars: collecting only what we genuinely need, using data only for the purposes stated in this Policy, protecting data with industry-standard security measures, and respecting every individual's rights over their own information.

This Policy should be read alongside the pkko Terms & Conditions and the Responsible Gaming page, both of which contain additional provisions relevant to the processing of your personal data. In the event of any conflict between this Policy and any other document on the Platform, this Privacy Policy shall govern matters relating to personal data protection.

For the purposes of this Privacy Policy, pkko acts as the data controller in respect of all personal data collected from users of the Platform. As the data controller, pkko determines the purposes for which personal data is collected and the means by which it is processed.

All data-related queries, rights requests, and complaints should be directed to the pkko Data Privacy contact point:

• Email: [email protected] — use the subject line "Data Privacy Request" for all privacy-related enquiries.
• Response Time: pkko aims to acknowledge all data-related requests within 48 hours and provide a substantive response within 14 calendar days.
• Availability: Our support team handles privacy enquiries 24 hours a day, 7 days a week, including Bangladeshi public holidays.

pkko processes personal data of players primarily located in Bangladesh. Our Platform is designed for, and marketed to, adult players aged 21 and above who are resident in Bangladesh or accessing the Platform from Bangladesh.

pkko collects personal data in several categories, depending on the nature of your interaction with the Platform. The following table summarises the categories of data collected and representative examples of each:

pkko does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data (other than photo ID for KYC purposes), or health information, unless specifically required to fulfil a legal obligation.

pkko collects personal data through three primary channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, place a bet, participate in a promotion, or contact the support team via live chat or email.
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you access or navigate the Platform. This includes IP address, device identifiers, and clickstream data collected without any active input from you.
• From third parties — including identity verification providers who confirm the authenticity of your KYC documents, payment processors who confirm transaction status, and fraud detection services that flag suspicious activity patterns. pkko only receives from third parties the minimum data necessary for the specific purpose in question.

pkko processes personal data only when there is a clear and legitimate purpose for doing so. The table below sets out the main processing activities, the purpose of each, and the legal basis on which we rely:

pkko will not use your personal data for any purpose that is incompatible with those described above without providing prior notice and, where required, obtaining your consent.

pkko does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment Processors: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and partner banks receive transaction reference data and account identifiers necessary to process your deposits and withdrawals. These providers operate their own independent privacy policies.
• KYC & Identity Verification Partners: Specialist verification providers receive copies of the identity documents you submit in order to confirm authenticity. All such providers are contractually bound to process your data solely for verification purposes and to delete source documents after verification is complete.
• Game Software Providers: Third-party providers including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, and Microgaming may receive an anonymised player identifier and bet data necessary to run the games you play. These providers do not receive your name, contact details, or financial information.
• Fraud Detection & Security Services: Anti-fraud and anti-money-laundering service providers may receive IP addresses, device fingerprints, and transaction patterns to identify suspicious activity. All such providers are engaged under strict data processing agreements.
• Law Enforcement & Regulatory Authorities: pkko will disclose personal data to relevant authorities where required by law, court order, or in connection with a legitimate law enforcement investigation. pkko cooperates fully with law enforcement agencies in Bangladesh and internationally in respect of financial crime investigations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of pkko's business, personal data held by pkko may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections.

pkko retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with pkko, plus a minimum of five years following account closure, to satisfy anti-money-laundering record-keeping obligations.
• KYC Verification Documents: Retained for a minimum of five years from the date of verification or from the date the account is closed, whichever is later. Original document images are deleted from third-party verification systems upon verification completion; only verification outcome records are retained by pkko.
• Transaction Records: All deposit and withdrawal records, including amounts in BDT (৳), MFS account references, and transaction timestamps, are retained for a minimum of five years from the date of the transaction.
• Support Communications: Live chat transcripts and support email records are retained for two years from the date of the interaction and may be retained longer if the communication relates to an active dispute or legal matter.
• Marketing Consent Records: Records of your opt-in or opt-out status for marketing communications are retained for as long as your account exists plus three years, to provide evidence of consent in the event of a complaint.
• Technical and Usage Data: Anonymised or aggregated analytics data may be retained indefinitely for Platform improvement purposes. Raw technical data such as IP logs are retained for no longer than 12 months from collection.

Upon expiry of the applicable retention period, pkko will securely delete or anonymise your personal data. Where deletion is not immediately practicable due to technical constraints, the data will be isolated from active processing systems and scheduled for deletion at the earliest available opportunity.

pkko has implemented a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in Transit: All data exchanged between your device and pkko servers is encrypted using 256-bit SSL/TLS protocols. You can verify the security of your connection by checking for the padlock icon in your browser's address bar when visiting pkko.im.
• Encryption at Rest: Sensitive personal data stored in pkko databases — including identity data, financial data, and KYC records — is encrypted at rest using industry-standard symmetric encryption.
• Access Controls: Access to personal data within pkko's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are required to complete data protection training and are bound by confidentiality obligations.
• Password Security: Account passwords are stored as salted cryptographic hashes. pkko never stores or transmits plain-text passwords and will never ask you to reveal your password via email or live chat.
• Session Security: Player sessions are protected by expiry tokens. We recommend using a unique, strong password for your pkko account and logging out when using shared or public devices.
• Third-Party Security Assessments: Key third-party partners (payment processors, KYC providers, game software providers) are required to demonstrate adequate information security standards as a condition of their engagement with pkko.
• Incident Response: pkko maintains an internal data breach response procedure. In the event of a data breach that poses a risk to affected individuals, pkko will notify the affected players without undue delay and take all reasonable steps to contain and remediate the incident.

As a user of the pkko Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Privacy Request" and specify which right you wish to exercise. We will respond within 14 calendar days of receiving a valid request.

• Right of Access: You may request a copy of the personal data pkko holds about you, along with information about how it is being used, the categories of recipients it has been shared with, and the retention period that applies.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): In certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected — you may request that we delete your personal data. This right is subject to our legal data retention obligations described in Section 7.
• Right to Restriction of Processing: You may request that we temporarily suspend the processing of your data in specific circumstances, such as while a complaint is being investigated or the accuracy of the data is being contested.
• Right to Data Portability: Where data is processed on the basis of your consent or a contract, you may request that we provide your personal data to you in a structured, commonly used, machine-readable format so that it can be transferred to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. If you raise a valid objection, pkko will cease the relevant processing unless there are compelling legitimate grounds that override your interests.

pkko uses cookies and similar tracking technologies on the Platform to ensure core functionality, improve performance, and — where you have consented — deliver a more personalised experience. A cookie is a small text file stored on your device when you visit a website. Cookies do not contain executable code and cannot be used to access other files on your device.

The following categories of cookies are used on pkko.im:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They maintain your login session, remember your language and currency preferences, enable secure payment flows, and support fraud prevention mechanisms. These cookies cannot be disabled without severely impairing your ability to use the Platform.
• Performance & Analytics Cookies: These cookies collect anonymised information about how players interact with the Platform — which pages are visited most frequently, how long sessions last, and where players encounter errors. The data collected is aggregated and used solely to improve Platform performance and user experience.
• Functional Cookies: These cookies allow the Platform to remember choices you have made — such as your preferred game category, notification settings, or display preferences — and provide a more personalised experience during your session.
• Marketing & Targeting Cookies: These cookies are only set with your explicit consent. They are used to identify your interests and deliver relevant promotional content, including bonus offers tied to upcoming BPL seasons, Eid promotions, and other seasonal campaigns. You may withdraw your consent at any time via your Account settings.

You can manage cookie preferences at the browser level through your device settings. Most modern browsers allow you to block or delete cookies. Please be aware that blocking strictly necessary cookies will prevent you from logging in or using core Platform features. Detailed browser-specific instructions for managing cookies are available on each browser's official help pages.

The pkko Platform is strictly intended for adults aged 21 and above. pkko does not knowingly collect, process, or store personal data relating to any individual under the age of 21. Registration on the Platform requires confirmation that the applicant is at least 21 years of age, and all accounts are subject to identity verification that includes confirmation of date of birth.

If pkko discovers or is notified that personal data belonging to an individual under 21 years of age has been collected — whether through a false declaration of age during registration or any other means — the following actions will be taken immediately:

• The relevant account will be suspended and then permanently closed.
• All personal data associated with the underage user will be deleted from pkko's active systems as quickly as technically practicable, subject to any mandatory legal retention obligations.
• Any funds held in the account will be returned via the payment method used for the original deposit, after deducting any amounts representing bonus funds that were unlawfully claimed.
• The incident will be reviewed by the pkko compliance team and, where appropriate, reported to relevant authorities.

If you have reason to believe that a person under the age of 21 has registered an account on pkko.im, please report this to [email protected] immediately with as much detail as possible. pkko takes all underage gambling reports seriously and will act without delay.

pkko may send you promotional communications — including bonus offers, reload promotions, free bet credits, tournament invitations, and seasonal campaign announcements — by email or push notification, but only where you have given your explicit consent to receive such communications. Consent is collected at the point of registration via an opt-in checkbox and can be managed at any time from your Account settings.

The types of marketing communications pkko may send to opted-in players include:

• Welcome bonus and first deposit match offer announcements.
• BPL T20, IPL, and ICC tournament betting promotions during the relevant cricket seasons.
• Seasonal promotions tied to Eid, Pohela Boishakh (Bengali New Year), Victory Day (16 December), and Independence Day (26 March).
• New game launch notifications for slots, live casino games, and crash games added to the Platform.
• Personalised bonus offers based on your gameplay history and preferences, where you have consented to personalised marketing.

You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, by adjusting your notification preferences in your Account settings, or by contacting [email protected] with the subject line "Marketing Opt-Out". Opting out of marketing will not affect your ability to receive transactional communications such as deposit confirmations, withdrawal notifications, account security alerts, and KYC status updates, which are sent regardless of your marketing preference because they are necessary for the operation of your account.

The pkko Platform may contain references to, or integrations with, third-party services including game software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, as well as payment processing partners including bKash, Nagad, Rocket, Upay, and partner banking institutions. pkko's Privacy Policy does not apply to the data practices of these third parties.

When you interact with third-party game software running within the Platform, the game provider may collect certain technical data — such as your anonymised player identifier, game session data, and bet outcomes — directly. pkko does not control the data processing activities of game providers and encourages you to review the privacy policies of any third-party provider whose services you use.

Similarly, when you complete a payment transaction via bKash, Nagad, or another mobile financial service, you are interacting with that provider's own platform and systems. Your use of those payment services is governed by that provider's terms and privacy policy. pkko receives only the transaction confirmation and reference data necessary to credit or debit your pkko account balance; it does not have access to your full MFS account history or PIN.

pkko reserves the right to update or amend this Privacy Policy at any time. The revised Policy will be published on this page with an updated "Last Updated" date displayed prominently at the top of the document. It is your responsibility to review this page periodically to remain informed of any changes.

Where amendments are material — for example, where they significantly affect the way pkko uses your personal data or the rights available to you — pkko will take additional steps to notify registered players, which may include sending a notification to your registered email address or displaying a prominent notice within the Platform on your next login. Material amendments will be effective no sooner than 14 days after the date of notification to give players sufficient time to review the changes.

For non-material amendments — such as corrections of typographical errors, clarifications of existing practices that do not change the substance of the Policy, or updates to contact details — the revised Policy will take effect immediately upon publication. Your continued use of the Platform following the publication of any amended Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way pkko handles your personal data, please contact us using the details below. All privacy-related enquiries are handled with strict confidentiality by our dedicated support team.

• Email: [email protected] — use the subject line "Data Privacy Request" for all privacy-related queries, access requests, correction requests, and deletion requests.
• Response Time: pkko aims to acknowledge all privacy requests within 48 hours and provide a full response within 14 calendar days of receiving a valid, verifiable request.
• Live Chat: Available on-site at pkko.im around the clock. For time-sensitive privacy concerns — such as a suspected data breach or unauthorised account access — live chat is the fastest way to reach our team.

If you are not satisfied with pkko's response to your privacy complaint or data rights request, you have the right to escalate the matter. Please send a follow-up email to [email protected] with the subject line "Formal Privacy Complaint" and a description of why you consider the initial response to be inadequate. The pkko compliance team will review your escalated complaint and provide a final written response within 21 calendar days.

pkko is committed to resolving all privacy concerns fairly and transparently. We do not fabricate regulatory certifications or claim approval from any specific governmental licensing or data protection authority. Our data handling practices are guided by recognised international data protection principles, including purpose limitation, data minimisation, storage limitation, integrity, and confidentiality.