pkoko Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") sets out the basis on which pkoko ("we", "us", "our", "the Platform") collects, processes, stores, and shares personal data relating to individuals ("you", "your", "the Player") who access or use the pkoko website at https://pkoko.bio and all associated services, including the sportsbook, casino, live dealer games, payment portal, and customer support channels (collectively, "the Service").

pkoko is committed to handling personal data responsibly and transparently. This Policy is designed to give you a clear understanding of what data we hold about you, why we hold it, how long we keep it, and what choices you have in relation to it. We encourage you to read this Policy carefully alongside our Terms & Conditions and Responsible Gaming page, both of which are connected to our data processing practices.

By creating an account on pkoko or continuing to use the Service after any update to this Policy, you acknowledge that you have read and understood its contents. If you do not agree with this Policy, please discontinue use of the pkoko platform.

2. Data Controller Information

pkoko is the data controller responsible for the personal data collected through the Service. For all privacy-related enquiries, data subject requests, and complaints, you may contact us using the details provided in Section 16 of this Policy.

Where pkoko engages third-party processors to handle data on its behalf — such as payment processors, identity verification providers, and analytics platforms — those processors act as data processors under pkoko's instruction and are bound by data processing agreements that restrict their use of your data to the purposes defined by pkoko.

3. Data We Collect

pkoko collects the following categories of personal data in connection with the operation of the Service:

3.1 Identity and Contact Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you meet the 18+ age requirement).
• Residential address, including city, district, and postcode (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar).
• Email address used for account registration and communications.
• Mobile phone number, particularly where linked to a mobile financial service account (bKash, Nagad, Rocket, or Upay).
• Copies of identity documents submitted during KYC verification, including national identity cards (NID), passports, or driver's licences.

3.2 Financial and Transaction Data

• Details of deposits, withdrawals, and transaction history on the pkoko platform.
• Payment method identifiers (e.g., mobile number associated with a bKash or Nagad account, masked card numbers for Visa or Mastercard transactions).
• Bank account or mobile banking references used for payment processing.
• Currency preference (BDT or INR) and exchange rate data where applicable.

3.3 Account and Activity Data

• Username, account ID, and encrypted password hash.
• Betting history, game session records, casino activity, and wagering patterns.
• Bonus and promotional redemption history.
• Responsible gaming settings and limits applied to your account.
• Customer support correspondence and complaint records.

3.4 Technical and Device Data

• IP address and approximate geolocation derived from IP data.
• Device type, operating system, and browser information.
• Session timestamps, login history, and session duration.
• Referral source and navigation path within the pkoko platform.

4. How We Collect Your Data

pkoko collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your profile settings.
• Automated collection: Technical data collected automatically when you interact with the pkoko website, including through cookies, server logs, and session tracking systems.
• Third-party sources: Identity and fraud risk signals received from authorised identity verification providers and payment processors during the account verification process.
• Responsible gaming monitoring: Behavioural data collected by pkoko's internal responsible gaming systems designed to identify patterns consistent with problem gambling, in accordance with our duty of care obligations.

5. How We Use Your Data

pkoko uses the personal data it collects for the following purposes:

pkoko does not use personal data for automated decision-making that produces legal or similarly significant effects without human review. Where automated systems flag an account for fraud or responsible gaming review, the final decision is reviewed by a member of the pkoko compliance team.

6. Legal Basis for Processing

pkoko processes personal data on the following legal bases:

• Contractual necessity: Processing required to provide the Service under the Terms & Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws, including identity verification, age verification, anti-money laundering obligations, and responsible gaming duties.
• Legitimate interests: Processing undertaken in the legitimate interests of pkoko or third parties, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, and informed consent — for example, receiving promotional emails or SMS notifications. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting support.

7. Payment Data and Financial Information

pkoko takes the security of financial data with the utmost seriousness. All payment transactions on the pkoko platform are processed through authorised third-party payment processors. The following principles govern our handling of financial information:

• pkoko does not store full payment card numbers (PAN) on its own servers. Card transactions are tokenised by our payment processor partner prior to transmission.
• Mobile financial service transactions via bKash, Nagad, Rocket, and Upay are processed through the respective operator's API. pkoko retains only the transaction reference and the mobile number used for the transaction, not the account PIN or full authentication credentials.
• Bank transfer details are retained only to the extent required to process the payment, reconcile the transaction, and comply with financial record-keeping obligations.
• All financial data in transit between your device and pkoko's payment gateway is protected by SSL/TLS encryption.
• Transaction records are retained for a minimum of five years from the date of the transaction, consistent with standard financial record-keeping requirements.

8. Cookies and Tracking Technologies

pkoko uses cookies and similar technologies (such as local storage and session tokens) to operate and improve the Service. The table below summarises the types of cookies in use:

pkoko does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. Analytics data is processed in aggregated, anonymised form where possible. Strictly necessary cookies cannot be disabled as they are essential to the functioning of the Service.

You may manage optional cookies through your browser settings. Note that disabling functional or analytics cookies may affect certain features of the pkoko platform, such as saved preferences and session continuity.

9. Data Sharing and Third Parties

pkoko does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes under any circumstances. Data is shared with external parties only in the following limited and controlled circumstances:

• Payment processors: Authorised providers processing BDT transactions (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank) and international card transactions (Visa, Mastercard) receive only the transaction data necessary to process and settle payments.
• Identity verification providers: KYC and anti-fraud service providers receive identity document data for the sole purpose of verifying account holder identity and assessing fraud risk signals. These providers are contractually prohibited from using your data for any other purpose.
• Game content providers: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive an anonymised session token to authenticate your game session. These providers do not receive your full identity data.
• Legal authorities: pkoko may disclose personal data to law enforcement agencies, courts, regulators, or other public authorities where required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity.
• Professional advisers: Legal, accounting, and auditing professionals engaged by pkoko may access personal data on a confidential basis to the extent necessary to provide their services.

10. International Data Transfers

pkoko operates as a cross-border South Asian platform serving players who transact in both BDT and INR. As a result, some personal data may be processed or stored on servers or by service providers located outside Bangladesh.

Where personal data is transferred outside the player's home jurisdiction, pkoko takes appropriate steps to ensure that such transfers are subject to adequate protections, including standard contractual clauses, data processing agreements, or transfers to jurisdictions that maintain adequate data protection standards.

If you have questions about the specific safeguards applied to international transfers of your data, please contact pkoko at [email protected].

11. Data Retention

pkoko retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Active account data: Retained for the duration of your account's active status plus a minimum of five years following account closure, consistent with financial record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five years from the date of submission or account closure, whichever is later.
• Transaction records: Retained for a minimum of five years from the date of the relevant transaction.
• Customer support records: Retained for three years from the date of the last interaction, unless the matter relates to an ongoing dispute or legal proceeding.
• Technical and device data: Retained for up to 24 months from the date of collection, after which it is anonymised or deleted.
• Marketing consent records: Retained until consent is withdrawn and for one year thereafter to demonstrate compliance.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identified individual.

12. Your Privacy Rights

Subject to applicable law, you have the following rights in relation to the personal data pkoko holds about you:

• Right of access: You may request a copy of the personal data pkoko holds about you, along with information about how it is processed.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected. You may also update certain data directly through your pkoko account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to pkoko's legal retention obligations.
• Right to restriction: You may request that pkoko restricts the processing of your data in certain circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to data portability: Where processing is based on your consent or a contract, you may request that pkoko provides your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or direct marketing at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, submit a written request to [email protected]. pkoko will respond within 30 calendar days of receiving a valid request. pkoko may request proof of identity before processing a data subject request to prevent unauthorised disclosure of personal data.

13. Data Security

pkoko implements a layered approach to data security that combines technical, organisational, and procedural controls. Measures in place include:

• SSL/TLS encryption for all data in transit between user devices and pkoko servers.
• Encryption at rest for sensitive data categories including identity documents and financial records.
• Role-based access controls restricting employee access to personal data on a need-to-know basis.
• Multi-factor authentication for internal system access by pkoko staff.
• Regular security assessments and penetration testing of the pkoko platform.
• Incident response procedures covering detection, containment, notification, and remediation of data security events.

While pkoko takes all reasonable precautions to protect your data, no system is entirely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights and freedoms, pkoko will notify affected players without undue delay and provide information on the nature of the breach and recommended protective actions.

14. Children's Privacy

The pkoko platform is strictly intended for adults aged 18 years and over. pkoko does not knowingly collect personal data from individuals under the age of 18. If you have reason to believe that a person under the age of 18 has created an account or submitted personal data to pkoko, please contact us immediately at [email protected].

Upon receiving a credible report of underage account use, pkoko will promptly suspend the account, delete any personal data associated with the underage individual, and return any deposits made, subject to standard verification checks. Age verification is a mandatory step of pkoko's KYC process, and accounts that fail age verification are permanently closed.

15. Changes to This Policy

pkoko reserves the right to update or amend this Privacy Policy at any time. When material changes are made, pkoko will make reasonable efforts to notify affected players via in-platform notification or email to the registered account address. Non-material clarifications may be made without direct notification.

The effective date of the most recent version of this Policy is displayed at the top of this page. Continued use of the pkoko platform following publication of an updated Policy constitutes acceptance of the revised terms. It is your responsibility to review this page periodically to stay informed of how your data is being handled.

16. Contact and Complaints

For all privacy-related enquiries, data subject access requests, or complaints regarding pkoko's data processing practices, please use the following contact details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the in-platform support widget
• Response Time: Within 30 calendar days for formal data subject requests; within 2 business days for general privacy enquiries
• Operating Hours: Bangladesh Standard Time (BST, UTC+6), 24 hours per day, 7 days per week

If you believe pkoko has not handled your personal data in accordance with this Policy and you are not satisfied with our response to your complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction or pursue independent legal advice.

pkoko is committed to resolving all privacy complaints promptly and fairly. We treat every data subject request with the same seriousness as a customer support or compliance matter, and our dedicated privacy team reviews all formal requests personally.