khelkaro Privacy Policy

1 Information We Collect

khelkaro collects personal data from players in Bangladesh through several channels: directly when you register an account, indirectly through your use of the platform, and from third-party service providers such as payment processors and identity verification partners. The categories of data we collect are described below.

1.1 Information You Provide Directly

When you register for a khelkaro account, complete identity verification (KYC), contact our support team, or participate in promotions, you may provide us with the following categories of personal information:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (used to verify that you are 18 years of age or older)
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna) and postal code
• Email address and mobile phone number
• Username and hashed password
• Copies of government-issued identity documents (National Identity Card, passport, or driving licence) submitted for KYC verification
• Proof of address documents (utility bill, bank statement dated within 90 days)
• Payment method details, including mobile wallet numbers (bKash, Nagad, Rocket, Upay) and card details (Visa, Mastercard) — card numbers are tokenised and never stored in full on our servers
• Any correspondence you send to our customer support team, including chat transcripts and email exchanges

1.2 Information Collected Automatically

When you access and use the khelkaro platform, certain technical and behavioural data is collected automatically through cookies, log files, and similar tracking technologies:

• IP address and approximate geographic location (country and city level)
• Device type, operating system, browser type and version
• Pages visited, features used, and time spent on the platform
• Game session data including bets placed, game outcomes, and session duration
• Transaction logs including deposit amounts, withdrawal requests, and timestamps
• Referring URL (the website or source that directed you to khelkaro)

1.3 Information From Third Parties

We may receive personal data about you from the following categories of third-party sources:

• Payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard): transaction confirmation data and wallet/account holder name verification
• Identity verification services: confirmation of document authenticity and age verification results
• Anti-fraud and AML screening services: risk scores and watchlist screening results to meet our regulatory obligations
• Analytics partners: aggregated, anonymised behavioural data used to improve platform performance (no individual-level re-identification)

2 How We Use Your Data

khelkaro processes your personal data only for specified, explicit, and legitimate purposes. The table below sets out the primary purposes for which we use your data, together with the legal basis for each processing activity.

khelkaro does not use your personal data for automated individual decision-making or profiling that produces legal or similarly significant effects, except where required to meet anti-money-laundering screening obligations — in which case you have the right to request human review of any automated decision that affects your account.

2.1 Marketing Communications

If you have opted in to receive promotional emails or SMS messages from khelkaro, we will use your contact information to send you relevant offers, bonus notifications, and platform updates. You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your account settings or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal.

3 Data Sharing & Third Parties

khelkaro does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

3.1 Service Providers

We engage trusted third-party service providers who process personal data on our behalf under strict data processing agreements. These providers are authorised to use your data only as directed by khelkaro and in accordance with this Privacy Policy. Categories of service providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa network, Mastercard network — to process your deposits and withdrawals
• KYC and identity verification providers: to verify your identity documents and confirm your age and address
• Cloud infrastructure and hosting providers: to store and serve platform data securely
• Customer support platform providers: to manage live chat and email support queues
• Analytics providers: to analyse aggregated, anonymised platform usage data
• Anti-fraud and AML compliance providers: to screen transactions and player accounts against sanctions lists and fraud databases

3.2 Legal and Regulatory Disclosures

khelkaro may disclose your personal data to law enforcement agencies, regulatory bodies, or other competent authorities where we are required to do so by law, court order, or where we reasonably believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity. We will notify you of any such disclosure where we are legally permitted to do so.

3.3 Business Transfers

In the event that khelkaro is involved in a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the privacy terms governing your data before the transfer takes effect.

4 Cookies & Tracking Technologies

khelkaro uses cookies and similar technologies (such as local storage and session storage) to operate the platform, remember your preferences, maintain your login session, and analyse how the platform is used. By continuing to use khelkaro after being informed of our cookie use, you consent to the placement of cookies on your device in accordance with this policy.

4.1 Types of Cookies We Use

4.2 Managing Cookies

You may control or disable cookies through your browser settings at any time. Please note that disabling essential cookies will impair your ability to log in to and use the khelkaro platform. Instructions for managing cookies are available in the help documentation for all major browsers including Chrome, Firefox, Safari, and Edge. Disabling analytics or functional cookies will not prevent you from using the core platform features.

khelkaro does not use third-party advertising cookies or retargeting pixels. We do not participate in cross-site behavioural advertising networks.

5 Data Retention

khelkaro retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or for as long as is required by applicable law — whichever period is longer. The following general retention periods apply:

• Account and registration data: Retained for the duration of your active account relationship with khelkaro, plus a minimum of 5 years following account closure, to meet anti-money-laundering record-keeping obligations.
• KYC / identity verification documents: Retained for a minimum of 5 years from the date of the most recent transaction on your account, in compliance with AML legislation.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction.
• Customer support correspondence: Retained for 3 years from the date of the most recent interaction, unless the correspondence relates to a dispute that is subject to ongoing proceedings.
• Marketing preferences and consent records: Retained for 3 years from the date of the most recent consent event or until you withdraw consent, whichever occurs first.
• Analytics and usage data (anonymised): May be retained indefinitely in aggregated, non-identifiable form.

Once the applicable retention period has expired and there is no ongoing legal requirement to retain your data, khelkaro will securely delete or anonymise your personal information. Secure deletion is performed in accordance with industry standards so that the data cannot be recovered or reconstructed.

6 Security Measures

khelkaro implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following controls:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and khelkaro servers is encrypted using 256-bit TLS encryption. Our platform enforces HTTPS across all pages and APIs.
• Password hashing: Account passwords are hashed using a modern, salted hashing algorithm. Plain-text passwords are never stored on our servers.
• Payment data tokenisation: Card payment details (Visa, Mastercard) are tokenised by our payment processing partner and are never stored in full on khelkaro infrastructure.
• Access controls: Access to personal data within the khelkaro organisation is restricted on a strict need-to-know basis. Staff who handle personal data undergo regular data protection training.
• Intrusion detection and monitoring: Our platform is monitored around the clock for suspicious activity, unusual login patterns, and potential security incidents.
• Regular security assessments: khelkaro conducts periodic security reviews and vulnerability assessments to identify and remediate potential weaknesses in our infrastructure.

6.1 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, khelkaro will notify you without undue delay via your registered email address. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps we have taken or intend to take to address the breach and mitigate its effects.

7 Your Privacy Rights

As a player on khelkaro, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact our support team in writing at support@khelkaro. We will respond to all verified requests within 30 days of receipt.

7.1 Right of Access

You have the right to request a copy of the personal data that khelkaro holds about you, together with information about how it is being used. This is commonly known as a Subject Access Request (SAR). There is no fee for making an access request under normal circumstances.

7.2 Right to Rectification

If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You may update basic account information directly through your account settings. For changes to identity documents or verified fields, please contact our support team.

7.3 Right to Erasure

You have the right to request that khelkaro deletes your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. Please note that this right is subject to our legal obligations to retain certain records for AML and financial compliance purposes; in such cases, we will delete all data that falls outside mandatory retention requirements.

7.4 Right to Restriction of Processing

You may request that khelkaro restricts the processing of your personal data in specific circumstances, such as while a rectification request is being assessed or where you have objected to processing pending verification of our legitimate grounds.

7.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.

7.6 Right to Object

You have the right to object to the processing of your personal data where that processing is based on our legitimate interests, including for direct marketing purposes. If you object to marketing communications, we will cease sending them promptly. If you object to other legitimate-interest processing, we will assess whether our interests are overridden by your rights and freedoms and respond accordingly.

7.7 Rights Related to Automated Decision-Making

Where khelkaro makes decisions about you using solely automated means that produce significant effects (for example, automated AML risk scoring that results in account restriction), you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

8 Policy Updates & Contact

khelkaro reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform functionality. The date of the most recent revision is displayed at the top of this page. For material changes — that is, changes that significantly affect how we use your personal data — we will notify you by email to your registered address or through a prominent notice on the khelkaro platform at least 14 days before the change takes effect. Your continued use of the platform after a policy update constitutes acceptance of the revised terms.

8.1 How to Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way khelkaro handles your personal data, please contact our Privacy team using the details below. We are committed to addressing all enquiries promptly and transparently.

• Email: support@khelkaro — please include "Privacy Request" in the subject line
• Response time: We aim to acknowledge all privacy enquiries within 2 business days (Bangladesh Standard Time, UTC+6) and to resolve them fully within 30 calendar days

khelkaro is committed to resolving privacy complaints fairly and efficiently. If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction.