Privacy Policy — khelabet

1 Data We Collect

khelabet collects personal data from you in order to provide, secure, and improve our online casino and sports betting services. We collect data through multiple touchpoints — during account registration, during the KYC verification process, through your ongoing use of the platform, and through automated technical systems such as cookies and server logs.

We apply a strict data minimisation principle: we collect only what is reasonably necessary to fulfil the specific purpose for which the data is needed. Below is a detailed breakdown of the categories of personal data we collect and the context in which each category is gathered.

1.1 Registration Data

When you create an account on khelabet, we collect the following information:

• Full legal name (as it appears on your government-issued identity document).
• Date of birth (to confirm you are 18 years of age or older).
• Residential address in Bangladesh (street address, city/district, postal code).
• Email address (used for account notifications, password recovery, and important communications).
• Mobile phone number (used for SMS verification and two-factor authentication).
• Username and encrypted password.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may request and store:

• Scanned copy or clear photograph of a government-issued photo ID (National Identity Card, passport, or driver's licence).
• Proof of residential address document (utility bill, bank statement, or government correspondence issued within the past 90 days).
• Proof of payment method ownership (e.g., screenshot of bKash or Nagad account showing the registered mobile number matching your account).
• Source of funds documentation for high-value transactions (where requested under our anti-money laundering procedures).

1.3 Financial Transaction Data

When you make deposits or request withdrawals via bKash, Nagad, Rocket, Upay, or bank transfer, we record:

• Payment method type and associated mobile number or bank account details.
• Transaction amounts in BDT (৳).
• Transaction timestamps and reference numbers.
• Deposit and withdrawal history associated with your account.

khelabet does not store full payment card numbers. All financial data is handled through encrypted payment channels provided by our verified payment partners.

1.4 Gameplay and Betting Data

We automatically record your activity on the platform, including:

• Games played, bet amounts, game outcomes, and session durations.
• Sports betting history — markets, selections, stake amounts, and results.
• Bonus and promotional offer usage and wagering progress.
• Responsible gaming tool activations (deposit limits, cool-off periods, self-exclusion requests).

1.5 Technical and Device Data

When you access khelabet, our servers and analytics systems automatically collect:

• IP address and approximate geolocation (country/city level).
• Device type, operating system, and browser version.
• Referring URL and pages visited within the platform.
• Session start and end times, page load performance metrics.

1.6 Customer Support Communications

When you contact our support team via live chat or email (support@khelabet), we retain a record of your inquiry, the support agent's responses, and any attachments you provide. These records are used to ensure quality, consistency, and accountability in our customer service.

2 How We Use Your Data

khelabet processes your personal data on the basis of contractual necessity (to deliver the services you have signed up for), legitimate business interests (to maintain platform security and prevent fraud), legal obligation (to comply with age verification and anti-money laundering requirements), and — where required — your explicit consent (for marketing communications).

2.1 Marketing Communications

khelabet will only send you promotional emails, SMS messages, or in-platform notifications about bonuses, seasonal offers (such as BPL or Eid promotions), or new game launches if you have explicitly opted in to receive such communications during registration or via your account preferences panel. You may withdraw this consent at any time by updating your notification preferences or by contacting support@khelabet.

2.2 Automated Decision-Making

khelabet uses automated systems to detect suspicious betting patterns, potential bonus abuse, and unusual account activity. These systems may automatically flag or temporarily restrict an account pending human review. You have the right to request human review of any automated decision that materially affects your account status.

3 Data Sharing & Disclosure

khelabet does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share your data only in the limited circumstances described below, and only to the minimum extent necessary to fulfil the relevant purpose.

3.1 Payment Processing Partners

To process your deposits and withdrawals, we share the necessary financial and identity data with our verified payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank (DBBL), City Bank, and BRAC Bank. These partners act as independent data controllers for the payment leg of each transaction and are governed by their own privacy policies and regulatory obligations under Bangladesh Bank guidelines.

3.2 Game Providers

When you play games powered by third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, a minimal set of technical data (including a session token, your anonymised player ID, and game configuration parameters) is passed to the game provider's servers to initialise and run the game. Your full name, contact details, and financial data are never shared with game providers.

3.3 Identity Verification Services

khelabet may use third-party identity verification providers to assist with KYC document processing. These providers are contractually bound to process your data only for the purposes of identity verification and are prohibited from using your data for any other purpose.

3.4 Legal and Regulatory Disclosures

khelabet may disclose your personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where required to do so by applicable law, valid legal process, or court order. We may also disclose data where disclosure is necessary to protect the rights, safety, or property of khelabet, our players, or the public.

4 Cookies & Tracking Technologies

khelabet uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to operate the platform effectively, personalise your experience, and analyse how the site is used. By continuing to use khelabet, you consent to the use of cookies in accordance with this policy.

4.1 Types of Cookies We Use

4.2 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Please be aware that disabling essential cookies will significantly impair your ability to log in and use the platform. For guidance on managing cookies in your specific browser, refer to your browser's help documentation. Note that third-party game providers (such as Evolution Gaming and Pragmatic Play) may set their own cookies within their game frames — these are governed by the respective provider's cookie policy.

5 Data Retention

khelabet retains your personal data for as long as your account is active and for a defined period thereafter, as required by our operational needs and applicable legal obligations. We do not retain personal data indefinitely — once the applicable retention period has elapsed, data is securely deleted or irreversibly anonymised.

5.1 Retention Periods by Data Category

• Account and registration data: Retained for the duration of your active account, plus 5 years following account closure (for anti-money laundering compliance purposes).
• KYC verification documents: Retained for 5 years from the date of verification or from the date of account closure, whichever is later.
• Financial transaction records: Retained for 7 years from the date of each transaction, in accordance with standard financial record-keeping practice.
• Gameplay and betting history: Retained for 3 years from the date of each session, then anonymised for aggregate analytics purposes.
• Customer support communications: Retained for 2 years from the date of the interaction.
• Technical and device data (server logs): Retained for 12 months, then purged.
• Marketing consent records: Retained for the duration of the consent period plus 3 years, to evidence compliance.

5.2 Account Closure and Data Deletion

When you request voluntary account closure, your real-money balance will be returned to your verified payment method. Your personal data will be retained for the minimum periods specified above and will not be used for marketing or profiling purposes following closure. After the applicable retention periods have elapsed, your data will be permanently and securely deleted from our systems.

Players who have been self-excluded may request deletion of marketing data immediately; however, core account and transaction data will be retained for the mandatory legal periods regardless of self-exclusion status.

6 Data Security

khelabet employs a comprehensive, layered approach to data security, designed to protect your personal information against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes both technical controls and organisational policies enforced across all staff and third-party partners who handle player data.

6.1 Technical Safeguards

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption at rest for all stored personal data, KYC documents, and financial records.
• Password hashing using industry-standard bcrypt with salt — your password is never stored in plain text.
• Two-Factor Authentication (2FA) available for all player accounts, strongly recommended.
• Web Application Firewall (WAF) to block common attack vectors including SQL injection, cross-site scripting (XSS), and brute-force login attempts.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Segregated access controls — customer support agents have access only to the specific account data necessary to resolve a query; no single employee has unrestricted access to the full player database.

6.2 Organisational Safeguards

• All staff with access to player data are required to complete data protection training as a condition of employment.
• Third-party service providers (payment processors, KYC providers, game studios) are vetted for their own data security standards and are bound by data processing agreements that require them to apply equivalent protections.
• Access to production systems is restricted to authorised personnel and is subject to multi-factor authentication and audit logging.

6.3 Data Breach Response

In the unlikely event of a data breach that affects your personal information, khelabet will notify affected players via their registered email address within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the data affected, the likely consequences, and the measures we have taken or are taking to address the breach.

7 Your Privacy Rights

As a player on khelabet, you hold a number of rights in relation to your personal data. khelabet is committed to honouring these rights promptly and transparently. To exercise any of the rights described below, please contact our support team via live chat or by emailing support@khelabet with the subject line "Privacy Rights Request".

7.1 Right of Access

You have the right to request a copy of all personal data that khelabet holds about you. We will provide this information in a structured, commonly used, machine-readable format within 5 business days of receiving your verified request. We may ask you to verify your identity before releasing this information to protect against fraudulent access requests.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (such as email address updates), this can be done directly through your account settings. For corrections to identity data (name, date of birth), you will need to provide supporting documentation.

7.3 Right to Erasure

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing was unlawful. Please note that this right is subject to overriding legal obligations — we are required to retain certain data (particularly financial transaction records and KYC documents) for mandatory regulatory periods even after account closure. In such cases, we will delete all data that is not subject to legal retention obligations and clearly explain what data must be retained and why.

7.4 Right to Restrict Processing

In certain circumstances — such as where you contest the accuracy of your data or where processing is unlawful — you may request that we restrict the processing of your personal data while the matter is under review. During a restriction period, we will store your data but will not actively process it.

7.5 Right to Object to Marketing

You have the absolute right to opt out of receiving marketing communications from khelabet at any time. You can do this by updating your communication preferences in your account settings, clicking the unsubscribe link in any marketing email, or by contacting support@khelabet. Opting out of marketing will not affect your ability to receive essential service communications (such as deposit confirmations, withdrawal notifications, and security alerts).

7.6 Right to Data Portability

Where data is processed on the basis of your consent or contractual necessity, you have the right to receive your personal data in a portable format and to request that it be transferred to another service provider where technically feasible.

8 Updates to This Policy

khelabet reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, new legal requirements, or improvements to our services. When material changes are made — particularly changes that affect how we use or share your personal data — we will notify registered players via their registered email address and display a prominent notice on the platform for at least 14 days before the changes take effect.

The updated policy will be published on this page with a revised effective date. Minor changes, such as clarifications that do not alter the substance of our data practices or corrections of typographical errors, may be published without direct notification, though the effective date will always reflect the most recent revision.

Your continued use of the khelabet platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with any changes, you have the right to request account closure and deletion of your data (subject to mandatory retention obligations) by contacting our support team.