Khela Privacy Policy – How We Protect Your Data

01 Who We Are

Khela is an online gaming platform operated at khela.app, designed specifically for players in Bangladesh. We offer a curated selection of online games including slots, table games, and live dealer experiences, all accessible via browser or the khela mobile app.

For the purposes of this privacy policy, khela is the data controller — meaning we are responsible for deciding how and why your personal data is processed. If you have any questions about how we handle your data, you can reach our privacy team directly at [email protected].

This privacy policy applies to all personal data collected through the khela website, mobile app, customer support channels, and any other interaction you have with the khela platform. It does not apply to third-party websites or services that may be linked from our platform — those have their own privacy policies that you should review separately.

02 Data We Collect

Khela collects personal data in three main ways: information you provide directly when registering or using the platform, information generated automatically by your use of the platform, and information we receive from third-party verification services. Here is a breakdown of what we collect and why.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information unless you voluntarily provide it in the context of a responsible gaming request (for example, if you disclose a gambling-related health concern when requesting self-exclusion).

03 How We Use Your Data

Every piece of data khela collects is used for a specific, legitimate purpose. We do not use your data for anything beyond what is described in this policy. Here is how we use the data we collect:

• Account management — Creating and maintaining your khela account, verifying your identity, and keeping your account secure.
• Payment processing — Facilitating deposits and withdrawals via bKash, Nagad, and bank transfer in BDT.
• Fraud prevention and security — Detecting and preventing unauthorised account access, bonus abuse, money laundering, and other prohibited activities.
• Regulatory compliance — Meeting our obligations under applicable anti-money-laundering and know-your-customer regulations.
• Responsible gaming — Monitoring gameplay patterns to identify signs of problem gambling and proactively offering support tools.
• Platform improvement — Analysing usage data in aggregate to improve the khela platform, fix bugs, and optimise the player experience.
• Customer support — Responding to your queries, resolving disputes, and improving the quality of our support service.
• Marketing — Sending promotional offers and updates to players who have opted in to receive them. You can opt out at any time.

We never use your personal data to make fully automated decisions that have a significant legal or similarly significant effect on you without human review. If any automated process flags your account for review, a member of our team will assess the situation before any action is taken.

04 Legal Basis for Processing

Khela processes your personal data on the following legal grounds, depending on the purpose of the processing:

• Contract performance — Processing necessary to provide the services you have signed up for, including account management and payment processing.
• Legal obligation — Processing required to comply with applicable laws, including anti-money-laundering regulations and identity verification requirements.
• Legitimate interests — Processing for fraud prevention, platform security, and improving our services, where these interests are not overridden by your privacy rights.
• Consent — Processing for marketing communications, where you have explicitly opted in. You can withdraw this consent at any time.

05 Cookies and Tracking

Khela uses cookies and similar tracking technologies to make the platform work properly, keep you logged in between sessions, and understand how players use the site so we can improve it. Here is what we use and why:

• Essential cookies — Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. You cannot opt out of these without stopping use of the platform.
• Functional cookies — Remember your preferences, such as your preferred language or display settings, so you do not have to set them every time you visit.
• Analytics cookies — Help us understand how players navigate the platform, which games are most popular, and where technical issues occur. This data is aggregated and anonymised.
• Security cookies — Used to detect and prevent fraudulent activity, including bot traffic and account takeover attempts.

You can manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using khela, but some features may not work as smoothly. We do not use third-party advertising cookies or sell cookie data to advertisers.

06 Data Sharing

Khela does not sell, rent, or trade your personal data. We share data only in the limited circumstances described below, and only with parties who are contractually obligated to handle it securely and in accordance with this policy.

• Payment processors — We share the minimum necessary data with bKash, Nagad, and banking partners to process your transactions. These providers have their own privacy policies and security standards.
• Identity verification services — We may share identity data with certified KYC (Know Your Customer) verification providers to confirm your identity as required by regulation.
• Fraud prevention services — We may share technical data (such as IP addresses and device fingerprints) with fraud detection services to protect the platform and its players.
• Legal and regulatory authorities — We will disclose personal data to law enforcement or regulatory bodies when required to do so by law, or when we believe disclosure is necessary to protect the safety of our players or the public.
• Business transfers — In the event of a merger, acquisition, or sale of khela's business, your data may be transferred to the new entity. We will notify you before this happens and explain your options.

07 Data Retention

Khela retains your personal data for as long as your account is active and for a defined period after account closure, as required by applicable regulations. The specific retention periods depend on the type of data and the reason it was collected.

• Account and identity data — Retained for the duration of your account and for five years after account closure, in line with standard anti-money-laundering record-keeping requirements.
• Transaction records — Retained for five years from the date of each transaction, as required by financial regulations.
• Support communications — Retained for two years from the date of the last interaction, to allow us to reference previous conversations if a related issue arises.
• Technical and usage data — Retained for 12 months in identifiable form, after which it is anonymised and may be retained indefinitely for aggregate analytics.
• Marketing preferences — Retained until you withdraw consent or close your account.

When data is no longer required, we delete it securely or anonymise it so it can no longer be linked to you. If you request deletion of your account, we will delete all data that we are not legally required to retain and confirm the deletion within 30 days.

08 Your Rights

You have a number of rights over your personal data held by khela. These rights are not absolute — in some cases they are subject to legal obligations that override them — but we will always tell you clearly if we cannot fulfil a request and explain why.

To exercise any of these rights, contact our privacy team at [email protected] with your account details and a description of your request. We will respond within 30 days. If you are not satisfied with our response, you have the right to escalate the matter to the relevant data protection authority.

09 Data Security

Khela takes the security of your personal data seriously. We have implemented a range of technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration.

• All data transmitted between your device and khela servers is encrypted using TLS 1.2 or higher.
• Sensitive data stored on our servers is encrypted at rest using AES-256 encryption.
• Access to personal data within khela is restricted to staff who need it to perform their job functions, and is governed by strict access controls.
• We conduct regular security audits and penetration testing to identify and address vulnerabilities.
• Our payment integrations are handled through PCI-DSS compliant providers — we never handle raw card or mobile banking credentials.
• We maintain an incident response plan and will notify affected players promptly in the event of a data breach that poses a risk to their rights or freedoms.

While we take every reasonable precaution to protect your data, no online platform can guarantee absolute security. You also play a role in keeping your account safe — use a strong, unique password and never share your login credentials with anyone.

10 Children's Privacy

Khela is strictly an adult platform. You must be at least 18 years of age to register an account or use any part of the khela service. We do not knowingly collect personal data from anyone under the age of 18.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data immediately and close the associated account. If you believe a minor has registered on khela, please contact us at [email protected] so we can investigate and take appropriate action.

Parents and guardians who are concerned about underage access to online gaming platforms are encouraged to use parental control software and to have open conversations with young people about responsible internet use.

11 Marketing Communications

Khela sends marketing communications — including promotional offers, bonus announcements, and platform updates — only to players who have explicitly opted in to receive them. We will never send unsolicited marketing messages.

You can manage your marketing preferences at any time through your account settings page, or by clicking the unsubscribe link in any marketing email we send you. Once you opt out, we will stop sending marketing communications within 48 hours. Note that opting out of marketing does not affect transactional communications — we will still send you account-related emails such as deposit confirmations, withdrawal notifications, and security alerts.

• Marketing emails will always include a clear unsubscribe link.
• We do not send marketing SMS messages without explicit consent.
• We do not share your contact details with third-party marketers.
• Opting out of marketing will not affect your ability to use the khela platform.

12 Policy Updates

Khela may update this privacy policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. When we make material changes, we will notify registered players via email and display a prominent notice on the platform for at least 14 days before the changes take effect.

The date at the top of this page shows when the policy was last updated. We recommend reviewing this policy periodically. Continued use of khela after the effective date of any changes constitutes your acceptance of the updated policy.

If you have any questions about this privacy policy, how we handle your data, or how to exercise your rights, please contact our privacy team at [email protected]. We aim to respond to all privacy-related enquiries within five business days.