pkla Privacy Policy —
Your Data, Handled with Care

1. Information We Collect

1.1 Information You Provide Directly

When you register a pkla account, complete KYC verification, make a deposit or withdrawal, or contact our support team, you voluntarily provide personal information. The categories of data we collect directly from you include:

• Identity data: Full legal name, date of birth, gender, and nationality as they appear on your government-issued identity document.
• Contact data: Email address, mobile phone number registered in Bangladesh, and residential address.
• Identity verification documents: Scanned or photographed copies of your National ID card (NID), passport, or driving licence; proof-of-address documents such as utility bills or bank statements dated within 90 days.
• Financial data: The mobile financial service account number (bKash, Nagad, Rocket, or Upay) or bank account details you use to deposit and withdraw funds. pkla does not store full card numbers or mobile banking PINs.
• Account credentials: Your chosen username and a hashed representation of your password. pkla never stores passwords in plain text.
• Support communications: Records of live chat conversations, emails, and any other written communication you send to pkla's support team.

1.2 Information Collected Automatically

When you access and use the pkla platform, certain technical and behavioural data is collected automatically through our servers, analytics systems, and cookies. This includes:

• Device and browser data: IP address, device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, time spent on each page, game sessions initiated and completed, bet history, deposit and withdrawal transaction logs, and login timestamps.
• Location data: General geographic location inferred from your IP address (country and city level only). pkla does not use GPS-level location tracking.
• Referral data: If you arrived at pkla via a referral link or affiliate partner, we record the referral source to administer any associated affiliate agreement.

1.3 Information from Third Parties

pkla may receive limited personal data about you from trusted third parties in connection with identity verification, payment processing, or fraud prevention. This includes identity verification results from KYC service providers, transaction confirmations from bKash, Nagad, Rocket, Upay, and banking partners, and fraud risk signals from payment processors. Data received from third parties is used only for the specific purpose for which it was shared and is subject to the same protections as data collected directly.

2. How We Use Your Data

pkla processes your personal data only where we have a lawful basis to do so. The following table summarises our primary processing activities and the legal basis for each:

pkla does not use your personal data to make fully automated decisions that produce significant legal effects on you without human review. Where automated risk-scoring tools are used to flag accounts (for example, for AML or bonus-abuse detection), a member of the pkla compliance team reviews the flag before any account action is taken.

3. Data Sharing and Disclosure

3.1 Who We Share Data With

pkla does not sell, rent, or trade your personal data. We share data only with the limited categories of recipients described below, and only to the extent necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — solely to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party services that assist pkla in verifying the authenticity of identity documents submitted during the KYC process.
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive only the minimum data required to deliver their games (typically a session token and stake data). They do not receive your full identity or financial details.
• Analytics and platform performance services: Aggregated and anonymised usage data may be processed by analytics tools to help pkla understand platform performance. These tools do not receive data that directly identifies you.
• Legal and regulatory authorities: pkla will disclose personal data when required to do so by applicable law, court order, or regulatory instruction — for example, in connection with an AML investigation or a law enforcement request supported by proper legal process.

3.2 International Data Transfers

Some of pkla's service providers operate infrastructure outside of Bangladesh. Where personal data is transferred to servers or processors in other countries, pkla takes steps to ensure that an equivalent level of data protection is applied, including through contractual data processing agreements that require the recipient to handle your data in accordance with this Privacy Policy.

4. Cookies and Tracking Technologies

4.1 What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit a website. pkla uses cookies and similar tracking technologies (such as local storage and session storage) to keep your session active, remember your preferences, and collect anonymised analytics about how the platform is used.

4.2 Types of Cookies Used by pkla

pkla does not place third-party advertising cookies or behavioural tracking cookies that build a profile of your browsing activity across other websites. You can manage cookie settings directly in your browser. Clearing cookies will log you out of your pkla session and may reset your functional preferences.

5. Data Retention

pkla retains your personal data for as long as your account remains active and for a defined period after account closure, as required by our legal and compliance obligations. The following retention periods apply:

• Account and identity data: Retained for the lifetime of your account and for a minimum of 5 years following permanent account closure, to satisfy AML record-keeping requirements.
• Transaction and betting history: Retained for a minimum of 5 years from the date of the transaction, in line with financial record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Support communications: Retained for 3 years from the date of the last correspondence, unless the communication is part of an active dispute or legal matter.
• Analytics data: Aggregated and anonymised analytics data may be retained indefinitely, as it cannot be used to identify you individually.
• Marketing consent records: Retained for the duration of your account and for 1 year following withdrawal of consent, as evidence of the consent lifecycle.

When the applicable retention period expires, pkla securely deletes or anonymises the relevant data. Secure deletion is applied to electronic records; physical documents (if any) are shredded using certified processes.

6. Your Privacy Rights

As a pkla player, you have specific rights with respect to your personal data. pkla is committed to honouring these rights promptly and transparently. Your rights include:

• Right of access: You may request a copy of all personal data pkla holds about you. We will provide this in a structured, readable format within 30 calendar days of receiving a valid request.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account details directly in the account settings panel; for identity and KYC data, contact support.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data. Note that pkla may be required to retain certain data (particularly transaction and KYC records) for legal compliance periods regardless of an erasure request. Where data must be retained, it will be restricted from active use.
• Right to restriction of processing: You may request that pkla limit the way it uses your data — for example, while a dispute about data accuracy is resolved.
• Right to data portability: You may request that pkla provide your personal data in a machine-readable format (such as JSON or CSV) so that it can be transferred to another service.
• Right to object: You may object to processing carried out on the basis of legitimate interest, including marketing communications. Objections to marketing are processed immediately.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, contact pkla's support team via on-site live chat or at [email protected] (plain text — not a link). We will verify your identity before processing a data rights request. All requests will be acknowledged within 5 business days and fulfilled within 30 calendar days.

7. Data Security Measures

pkla takes the security of your personal data seriously and applies a layered approach to protecting information held on our platform. Our security measures include:

• Transport Layer Security (TLS): All data transmitted between your browser and pkla's servers is encrypted using TLS 1.2 or higher, indicated by the HTTPS padlock in your browser address bar.
• Encryption at rest: Sensitive personal data stored in pkla's databases is encrypted using AES-256 symmetric encryption. Encryption keys are managed separately from the encrypted data.
• Password hashing: Account passwords are stored as bcrypt hashes with a per-account salt. Plain-text passwords are never written to disk or logs at any point.
• Two-factor authentication (2FA): pkla offers optional 2FA for all player accounts. We strongly recommend enabling 2FA in your account security settings to add an additional layer of login protection.
• Access controls: Access to player personal data within pkla's internal systems is restricted on a need-to-know basis. Staff access is role-based, logged, and audited regularly.
• Intrusion detection and monitoring: pkla's infrastructure is monitored 24/7 for anomalous activity, with automated alerts and response procedures for suspected security incidents.
• Penetration testing: pkla commissions periodic independent security audits and penetration tests of its platform to identify and remediate vulnerabilities before they can be exploited.

Despite these measures, no system connected to the internet can be guaranteed to be 100% secure. In the event of a security incident that affects your personal data, pkla will notify you as soon as reasonably practicable and will take all necessary steps to contain the breach and prevent recurrence.

8. Contact and Complaints

8.1 Contacting pkla About Privacy

If you have a question about this Privacy Policy, wish to exercise a data rights request, or want to report a potential data security concern, please reach out to the pkla support team through any of the following channels. All contact details are provided as plain text — they are not clickable links:

• On-site live chat: Available 24/7 at pkla.app — the fastest way to reach the team.
• Email (plain text): [email protected]
• WhatsApp (plain text): +880 1700 000000

Support is available 24 hours a day, 7 days a week on Bangladesh Standard Time (BST, UTC+6). All formal privacy requests must be submitted in English. We will acknowledge your request within 5 business days and aim to resolve it within 30 calendar days. If your request requires additional time due to complexity, we will inform you of the extended timeline in writing.

8.2 Changes to This Privacy Policy

pkla may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform features. When a material change is made, we will display an in-platform notification and update the "Last updated" date at the top of this document. We encourage you to review this policy periodically. Your continued use of pkla following the publication of any change constitutes your acknowledgement of the updated policy.

This Privacy Policy was last reviewed and updated on 1 January 2026. It supersedes all previous versions of the pkla Privacy Policy.