pkpo Privacy Policy

1 Introduction and Scope

This Privacy Policy applies to all personal data collected and processed by pkpo in connection with the operation of its online betting and gaming platform at pkpo.io. It covers all products and services offered by pkpo, including the cricket sportsbook, live casino, slots, esports betting, and table games such as 3-Hand Casino Hold'em.

By registering an account with pkpo, making a deposit, placing a wager, or simply visiting the pkpo website, you acknowledge that you have read and understood this Privacy Policy. Where your use of the platform is conditional on your consent to specific data processing activities, we will ask for that consent explicitly at the relevant point of interaction.

This policy should be read alongside the pkpo Terms and Conditions, which are available at pkpo.io/terms-conditions. In the event of any conflict between this Privacy Policy and the Terms and Conditions in relation to data handling matters, this Privacy Policy shall take precedence.

2 Data Controller Information

pkpo acts as the data controller in respect of all personal data collected from users of the platform. As data controller, pkpo determines the purposes for which personal data is processed and the means by which that processing takes place.

For all data-related enquiries, requests, and complaints, you may contact the pkpo data team using the following details:

• Email: [email protected]
• Subject line for data requests: "Data Privacy Request — [Your Account Username]"
• Response time: pkpo will acknowledge all data-related requests within 48 hours and provide a substantive response within 30 calendar days.

3 Categories of Personal Data We Collect

pkpo collects personal data in several categories depending on the nature of your interaction with the platform. The table below summarises the main categories of data collected:

pkpo collects only the minimum data necessary for the specific purpose at hand. We do not collect sensitive categories of personal data — such as racial or ethnic origin, political opinions, religious beliefs, or health data — unless directly relevant to a responsible gaming assessment, in which case your explicit consent will be sought before collection.

4 How We Collect Your Data

pkpo collects personal data through the following channels:

• Direct submission: Data you provide when creating an account, completing identity verification, making a deposit or withdrawal request, contacting support, or submitting feedback.
• Automated technical collection: Data collected automatically when you visit or interact with the pkpo platform, including IP addresses, cookies, session identifiers, and device fingerprinting. See Section 6 for full cookie details.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other approved payment partners when you make a deposit or withdrawal.
• Identity verification providers: Where pkpo engages a third-party provider to verify your age or identity, that provider may return a verification result and supporting data to pkpo.
• Fraud detection services: Risk signals, device reputation data, and behavioural anomaly flags may be received from third-party fraud prevention partners as part of pkpo's anti-fraud and anti-money-laundering programme.
• Public sources: In limited circumstances, pkpo may cross-reference data from publicly available sources (such as court records or regulatory watch lists) as part of enhanced due diligence on high-value accounts.

5 Purposes and Legal Bases for Processing

pkpo processes personal data only where a valid legal basis exists. The table below maps each processing purpose to its corresponding legal basis:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent can be requested by contacting pkpo support at [email protected].

6 Cookies and Tracking Technologies

pkpo uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain session security, and to understand how users interact with the site. The categories of cookies used on the pkpo platform are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, anti-CSRF tokens, and load-balancing identifiers. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: Store your preferences such as language settings, preferred sports market display, and responsible gaming tool configurations. Disabling these cookies may reduce your personalised experience.
• Analytical cookies: Collect anonymised or pseudonymised data on how users navigate the platform — pages visited, session lengths, and feature engagement rates. This data is used internally to improve platform design and game offering.
• Marketing and personalisation cookies: Used to tailor promotional content and bonus offers to your betting preferences and activity patterns. These cookies are only placed with your prior consent.

You can manage your cookie preferences at any time through the cookie settings panel, accessible from your account dashboard. Note that disabling strictly necessary cookies will prevent you from logging in or placing bets. pkpo does not use third-party advertising networks' tracking pixels on account-authenticated pages.

7 Data Sharing and Third-Party Disclosure

pkpo may share your personal data with the following categories of third parties:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — solely for the purpose of processing your deposit and withdrawal transactions.
• Identity and age verification providers: Third-party services engaged by pkpo to verify that users meet the 21+ age requirement and to confirm identity as part of anti-money-laundering checks.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited technical session data (such as a pseudonymised session token and wallet balance) to operate their games within the pkpo platform. These providers do not receive your full identity data.
• Fraud prevention and security services: Specialist providers that assist pkpo in detecting account takeover attempts, automated bot activity, and financial crime. Data shared is limited to technical and behavioural signals.
• IT infrastructure and cloud hosting providers: Companies providing secure server infrastructure, database hosting, content delivery, and backup services. These providers process data on pkpo's behalf under strict data processing agreements.
• Legal and regulatory authorities: Law enforcement agencies, financial intelligence units, or regulatory bodies where pkpo is legally required to disclose information — for example, in connection with a court order, suspicious activity report, or official investigation.
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by pkpo, subject to professional confidentiality obligations.

All third parties with whom pkpo shares personal data are required to process that data in accordance with applicable data protection law and the instructions of pkpo. pkpo conducts due diligence on all data processors before engagement and reviews those relationships periodically.

8 International Data Transfers

pkpo's primary user base is located in Bangladesh. However, some of the third-party service providers described in Section 7 — particularly game content providers and cloud infrastructure partners — may process data in locations outside Bangladesh.

Where personal data is transferred to a country that does not provide an equivalent level of data protection, pkpo ensures that appropriate safeguards are in place, including:

• Standard contractual clauses requiring the recipient to protect personal data to a standard equivalent to those applied by pkpo.
• Data processing agreements that restrict the recipient's use of the transferred data to the specified purpose only.
• Technical controls including encryption in transit (TLS 1.2 or higher) and encryption at rest for all data held on external servers.

If you have concerns about how your data is protected during international transfers, you may contact pkpo at [email protected] to request further information about the specific safeguards in place for any given transfer.

9 Data Retention

pkpo retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account legal, regulatory, and operational requirements. The following indicative retention periods apply:

• Active account data: Retained for the duration of your account plus 7 years following account closure, in order to satisfy financial record-keeping and anti-money-laundering obligations.
• Identity verification documents: Retained for a minimum of 5 years from the date of verification, or for 5 years following account closure, whichever is longer.
• Transaction records (deposits and withdrawals): Retained for 7 years from the date of each transaction.
• Betting history: Retained for the lifetime of your account plus 3 years following closure, for dispute resolution and audit purposes.
• Support communications: Retained for 3 years from the date of the last communication in a given case.
• Cookie and session data: Session cookies expire at the end of each login session. Persistent cookies expire according to the schedule communicated in the cookie settings panel, typically between 30 days and 12 months.
• Responsible gaming records: Retained for the duration of any self-exclusion period plus 5 years, to prevent circumvention of exclusion measures through re-registration.

When personal data is no longer required for any retention purpose, pkpo will securely delete or anonymise it. Anonymised data — which cannot be re-linked to any individual — may be retained indefinitely for aggregate statistical analysis.

10 Security Measures

pkpo implements a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• SSL/TLS encryption: All data transmitted between your device and the pkpo platform is encrypted using TLS 1.2 or higher. The padlock icon in your browser confirms an active encrypted connection.
• Password hashing: User passwords are never stored in plain text. They are processed using a one-way cryptographic hashing algorithm with a unique salt per account before storage.
• Two-factor authentication: pkpo supports optional two-factor authentication via one-time codes sent to your registered mobile number, providing an additional layer of protection beyond your password.
• Role-based access controls: Internal access to personal data is restricted to pkpo personnel who require it for their specific job function. Access logs are maintained and reviewed regularly.
• Automated fraud and anomaly detection: pkpo's platform monitors account activity in real time for signs of unauthorised access, unusual login patterns, and suspicious transaction behaviour.
• Regular security assessments: pkpo conducts periodic security reviews and vulnerability assessments of its platform infrastructure to identify and remediate potential weaknesses.

While pkpo takes all reasonable technical and organisational steps to protect your data, no internet-based platform can guarantee absolute security. You are responsible for keeping your own account credentials confidential and for notifying pkpo immediately if you suspect unauthorised access to your account.

11 Your Data Rights

As a user of the pkpo platform, you hold the following rights in respect of your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Account Username]". pkpo will respond within 30 calendar days.

• Right of access: You may request a copy of the personal data pkpo holds about you, along with information about how it is being processed.
• Right to rectification: If any personal data pkpo holds about you is inaccurate or incomplete, you may request that it be corrected or updated.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to pkpo's legal retention obligations. Note that certain financial and identity data must be retained by law for defined periods even after account closure.
• Right to restriction of processing: You may request that pkpo restricts processing of your data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that pkpo provides your personal data in a commonly used, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. Where you object to marketing, pkpo will cease that activity immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the validity of processing that took place before withdrawal.

pkpo will not charge a fee for exercising any of the above rights, except in cases where requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. pkpo will notify you in advance if a fee is applicable.

12 Children and Minors

pkpo employs age verification checks as part of the registration and identity verification process to help ensure that only adults aged 21 and above access the platform. These checks may include review of government-issued identity documents and cross-referencing with date-of-birth records.

13 Changes to This Privacy Policy

pkpo reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the structure of the pkpo platform. Where changes are material — meaning they affect how your data is used or your rights as a data subject — pkpo will provide at least 7 days' advance notice by publishing the updated policy on the platform and notifying registered users via their registered contact details where practicable.

The date at the top of this document indicates when the current version came into effect. Your continued use of the pkpo platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree to the updated policy, you should cease using the platform and may request account closure and data erasure as described in Section 11.

14 How to Contact Us

For any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact pkpo using the following channels. All contact details are provided as plain text only and are not clickable links:

• Email: [email protected]
• WhatsApp: +880 1700 000 000
• Live Chat: Available 24/7 directly within the pkpo platform after logging in
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6)
• Subject line for data requests: "Data Privacy Request — [Your Account Username]"

pkpo aims to acknowledge all privacy-related correspondence within 48 hours and to provide a full response within 30 calendar days. For complex requests requiring additional investigation, pkpo will notify you of any extension to this timeline before the initial 30-day period expires.