pgko Privacy &
Data Protection Policy

1 Introduction

This Privacy Policy ("Policy") describes how pgko ("the Company", "we", "us", "our") collects, uses, stores, shares, and protects personal data in connection with the operation of the pgko online betting and casino platform available at pgko.io (the "Platform").

pgko serves players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar, and is committed to handling personal data in a lawful, fair, and transparent manner. This Policy applies to all individuals who visit, register on, or interact with the Platform, regardless of the device or connection method used.

This Policy should be read alongside the pgko Terms & Conditions and the pgko Responsible Gaming Policy, both of which are incorporated into the overall agreement between you and pgko. In the event of any conflict between this Policy and any other pgko document, this Policy shall take precedence with respect to all matters relating to personal data.

2 Data Controller

pgko acts as the data controller in respect of all personal data collected through the Platform. As data controller, pgko determines the purposes for which personal data is processed and the means by which that processing is carried out.

All questions, requests, and correspondence relating to the collection or processing of personal data should be directed to pgko via the contact details set out in Section 15 of this Policy. pgko will acknowledge all privacy-related correspondence within 48 hours of receipt.

3 Data We Collect

pgko collects the following categories of personal data in connection with the operation of the Platform:

pgko does not intentionally collect special categories of personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless you voluntarily disclose such information in the course of a support interaction or responsible gaming request, in which case it will be handled with additional care and used only for the purpose for which it was provided.

4 How We Collect Your Data

pgko collects personal data through the following means:

• Direct provision by you: When you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion, you directly provide personal data to pgko.
• Automated technical collection: When you access and use the Platform, our systems automatically collect technical and usage data through cookies, server logs, and similar technologies. This includes your IP address, device identifiers, and session behaviour data.
• Payment providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the relevant payment provider shares transaction confirmation data with pgko to enable us to credit or debit your pgko wallet accurately.
• Identity verification partners: Where pgko engages a third-party identity verification service to assist with KYC checks, that provider may supply pgko with a verification result and associated identity data in connection with a specific verification request.
• Fraud prevention and security services: pgko may receive data from third-party fraud detection and device fingerprinting services as part of its efforts to protect the Platform and its players from fraudulent activity.

5 Purposes & Legal Basis for Processing

pgko processes personal data only where a lawful basis for processing exists. The table below sets out the primary purposes for which pgko processes personal data and the corresponding legal basis for each:

Where pgko relies on your consent as the legal basis for processing (for example, in the case of optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before the withdrawal. To withdraw consent, please contact [email protected].

6 Data Sharing & Third-Party Disclosure

pgko does not sell, rent, or trade your personal data to any third party for commercial purposes. pgko shares personal data only in the following circumstances:

• Payment processors: Transaction data is shared with bKash, Nagad, Rocket, Upay, and card payment processors solely for the purpose of completing the relevant financial transaction. Each payment partner operates under its own privacy policy and data handling obligations.
• Identity and fraud verification providers: Where pgko engages a third-party KYC or fraud detection service, the minimum data necessary to complete the verification or fraud assessment is shared with that provider under a formal data processing agreement.
• Game content providers: Third-party game studios (including Evolution Gaming, Pragmatic Play, Pragmatic Play Live, Ezugi, Microgaming, NetEnt, and Spribe) may receive limited technical data (such as a pseudonymised player reference and session token) to enable game delivery. These providers do not receive your full identity or contact data.
• Legal and regulatory compliance: pgko may disclose personal data to law enforcement agencies, regulators, or other competent authorities where required to do so by applicable law, court order, or regulatory requirement. pgko will notify you of such a disclosure where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of pgko's business, personal data held by pgko may be transferred to the acquiring entity as part of that transaction. Affected players will be notified in advance of any such transfer.

7 Cookies & Tracking Technologies

pgko uses cookies and similar tracking technologies to operate the Platform and improve the user experience. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session management cookies, authentication tokens, and security cookies that protect against cross-site request forgery (CSRF).
• Performance and analytics cookies: These cookies collect anonymised data about how players interact with the Platform — including which pages are visited most frequently and where errors occur — to help pgko improve site performance and reliability.
• Functionality cookies: These cookies remember your preferences (such as your preferred language and display settings) so that the Platform can deliver a more personalised experience on return visits.
• Fraud prevention and security cookies: pgko uses device fingerprinting and security cookies to identify and prevent fraudulent activity, including the detection of duplicate accounts and automated bot activity.

You may control cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing core Platform features, including login and payment functionality. Analytics and functionality cookies may be disabled without affecting your ability to use the Platform's core services.

8 Data Security

pgko takes the security of your personal data seriously and implements the following technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure:

• SSL/TLS encryption: All data transmitted between your device and the pgko Platform is encrypted using industry-standard SSL/TLS protocols. This applies to all pages of the Platform, including the login, registration, deposit, and withdrawal flows.
• Encrypted storage: Sensitive personal and financial data stored on pgko systems — including identity verification documents and payment method details — is stored in encrypted form.
• Access controls: Access to personal data within pgko's systems is restricted to authorised personnel who require access for the performance of their duties. Access privileges are reviewed regularly and revoked immediately upon change of role or departure from the organisation.
• Security monitoring: pgko maintains continuous monitoring of its systems for suspicious activity and applies automated alerting mechanisms to detect potential security incidents in real time.
• Incident response: In the event of a personal data breach that is likely to result in a risk to the rights of affected players, pgko will notify affected individuals as promptly as practicable and take all reasonable steps to contain and remediate the breach.

While pgko applies rigorous security measures, no online platform can guarantee absolute security against all threats. Players are encouraged to use strong, unique passwords for their pgko account, to enable any available two-factor authentication, and to contact support immediately if they suspect unauthorised account access.

9 Data Retention

pgko retains personal data for no longer than is necessary for the purpose for which it was collected, subject to the following minimum retention periods:

• Active account data: Retained for the full duration of your account with pgko, including any period during which the account is suspended or subject to a self-exclusion restriction.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the relevant transaction, in compliance with applicable AML and record-keeping obligations.
• Identity verification documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant KYC check, whichever is later.
• Support communications: Retained for a minimum of three (3) years from the date of the last communication, to enable pgko to respond to any subsequent disputes or regulatory enquiries.
• Betting and gaming records: Retained for a minimum of five (5) years from the date of the relevant bet or game session.
• Marketing consent records: Retained for as long as your consent remains active and for one (1) year following withdrawal of consent, as evidence of the lawful basis for prior marketing communications.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the individual to whom the data relates. Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes.

10 Your Data Rights

As a pgko player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact pgko via email at [email protected] with the subject line "Data Rights Request":

• Right of access: You have the right to request a copy of the personal data that pgko holds about you. pgko will provide this information within 30 days of receiving a verified request.
• Right to rectification: If you believe that any personal data held by pgko is inaccurate or incomplete, you have the right to request that it be corrected or supplemented. Many account details can be updated directly through your pgko account settings.
• Right to erasure: You may request that pgko delete your personal data where it is no longer necessary for the purpose for which it was collected and where no overriding legal obligation requires its retention. Please note that pgko is required by AML regulations to retain certain data for a minimum of five years, which may limit the scope of erasure requests.
• Right to restrict processing: In certain circumstances, you may request that pgko restrict the processing of your personal data — for example, while a dispute regarding the accuracy of the data is being resolved.
• Right to data portability: You may request that pgko provide your personal data in a structured, commonly used, and machine-readable format to enable you to transfer it to another service provider.
• Right to withdraw consent: Where pgko processes your personal data on the basis of your consent (e.g., for optional marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.
• Right to object: You may object to the processing of your personal data where pgko relies on legitimate interest as the legal basis, unless pgko can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

11 Children & Minors

pgko strictly prohibits the use of the Platform by any person under the age of 21. The Platform is designed for and directed exclusively at adults aged 21 and above. pgko does not knowingly collect personal data from any individual under the age of 21.

If pgko becomes aware that personal data has been collected from a person under the age of 21, it will take immediate steps to delete that data and close the relevant account. All balances held in an account that is found to belong to an underage player will be handled in accordance with pgko's responsible gaming and account closure procedures.

Parents and guardians who believe that a minor may have registered a pgko account or accessed the Platform are encouraged to contact [email protected] immediately. pgko will treat all such reports as high priority and will respond within 24 hours.

12 International Data Transfers

Some of pgko's service providers — including certified game studios such as Evolution Gaming, Pragmatic Play, Ezugi, Microgaming, NetEnt, and Spribe — operate infrastructure located outside Bangladesh. Where personal data is transferred to a country outside Bangladesh, pgko ensures that appropriate safeguards are in place to protect your data to an equivalent standard as if it remained within Bangladesh. These safeguards include contractual data processing agreements that impose obligations on the recipient equivalent to those applicable to pgko, and technical security measures such as encryption and pseudonymisation of data in transit.

pgko does not transfer full identity data or payment credentials to game studio providers. Only the minimum data necessary to deliver the relevant game session — such as a pseudonymised player reference, session token, and wager amount — is shared with third-party game content providers.

13 Third-Party Links & External Services

The pgko Platform does not contain links to third-party websites for general browsing or commercial referral purposes. All navigation within the Platform directs users to pgko-owned pages only. However, certain game content delivered by third-party studios (such as Evolution Gaming, Pragmatic Play, Ezugi, Microgaming, NetEnt, and Spribe) is loaded within an embedded frame as part of the pgko Platform experience.

pgko is not responsible for the privacy practices of third-party game studios or payment providers. Players are encouraged to review the privacy policies of any third-party service they interact with directly, including mobile payment applications such as bKash, Nagad, and Rocket, which operate under their own privacy frameworks.

14 Amendments to This Policy

pgko reserves the right to amend this Privacy Policy at any time. The most current version of this Policy will always be available at pgko.io/privacy-policy. The "Last updated" date at the top of the Table of Contents reflects the date on which the most recent revision was made.

Where a proposed amendment is material — meaning it significantly affects how pgko collects, uses, or shares your personal data — pgko will notify registered players by email to the address on file at least fourteen (14) days before the amendment takes effect. Minor amendments, such as corrections of typographical errors or clarifications that do not change the substance of the Policy, may be published without prior individual notice.

Your continued use of the pgko Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and contact [email protected] to request account closure.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by pgko, please contact us using the details below. All privacy-related correspondence is treated as confidential and is handled by pgko's designated privacy team.

• Platform: pgko.io
• Contact Method: Email only — pgko does not provide telephone or postal privacy support.
• Email Address: [email protected] (use subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate)
• Response Time: All privacy-related emails are acknowledged within 48 hours. Substantive responses and data rights actions are completed within 30 days of identity verification.
• Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)
• Response Language: English

pgko will never initiate contact requesting your password, payment PIN, or full payment card details. If you receive a communication purporting to be from pgko that requests such information, please disregard it and report it to [email protected] immediately.