Privacy Policy — khalibet

1. Data Controller Information

For the purposes of this Privacy Policy, the data controller responsible for the personal information collected through the khalibet platform is khalibet, operated as an online sports betting and casino platform serving registered players in Bangladesh. All data-related enquiries, access requests, correction requests, and deletion requests should be directed to our dedicated privacy contact:

khalibet processes personal data in accordance with this Privacy Policy and in compliance with applicable data protection principles, including the principle of data minimisation (collecting only what is necessary), the principle of purpose limitation (using data only for the purposes stated in this policy), and the principle of storage limitation (retaining data only for as long as necessary).

This Privacy Policy applies to all personal data collected through the khalibet website, progressive web application, and any associated communications channels including email correspondence with our support team. It applies to all registered players and to visitors who browse the platform without registering an account.

2. Personal Data We Collect

khalibet collects personal data through several distinct channels during your registration, account use, and interaction with our support and payment services. The categories of personal data we collect are set out below.

2.1 Registration Data

When you create a khalibet account, we collect the following information as part of the mandatory registration process:

• Full legal name
• Date of birth (for age verification purposes)
• Email address
• Mobile phone number (used for account communications and bKash/Nagad/Rocket payment linkage)
• Preferred username and hashed account password
• City or district of residence within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar)

2.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) obligations and to process withdrawal requests, we may request the following identity verification documents:

• National Identity Card (NID) — front and back scan or photograph
• Passport (bio-data page photograph)
• Birth certificate (where NID is unavailable)
• A recent utility bill or bank statement showing your name and address (as proof of residence, where required)
• A photograph of the payment method owner's identification as it relates to the withdrawal channel (e.g., bKash registration document)

2.3 Transactional Data

We record all financial transactions conducted through your khalibet account, including deposit amounts, withdrawal requests, bet placements, game wager amounts, bonus credits, and refunds. Transaction records are maintained in BDT (Bangladeshi Taka) and include timestamps in Bangladesh Standard Time.

2.4 Technical & Usage Data

When you access the khalibet platform, our servers automatically collect certain technical data, including:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and navigation path through the platform
• Session start and end times (in BST)
• Referring URL (the website or link that brought you to khalibet, if applicable)
• Error logs and crash reports (used solely for platform stability and debugging purposes)

2.5 Communications Data

If you contact our support team by email or through any messaging channel, we retain a record of that correspondence, including the content of your messages and our responses. This data is used to resolve your query, track issue resolution history, and improve our customer service quality.

2.6 Responsible Gaming Data

If you activate responsible gaming tools — such as deposit limits, session time limits, cooling-off periods, or self-exclusion — we record your settings and the dates on which they were applied or modified. This data is processed exclusively for the purpose of enforcing your responsible gaming choices and cannot be used for marketing profiling.

The following table summarises the legal basis for each category of data processing carried out by khalibet:

3. How We Use Your Data

khalibet uses the personal data described in Section 2 for the following specific and lawful purposes. We do not use your data for any purpose that is incompatible with the purposes listed below:

• Account Administration: Creating, maintaining, and managing your registered khalibet account, including processing login requests, password resets, and account settings changes.
• Payment Processing: Verifying and processing deposit and withdrawal transactions through bKash, Nagad, Rocket, Upay, and partner banks. Transaction records are maintained for financial audit purposes.
• Age & Identity Verification: Confirming that all players meet the minimum age requirement of 18 years and verifying that account details match submitted identity documents.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, including duplicate account creation, bonus abuse, money laundering, and unauthorised account access. This includes automated risk-scoring of account behaviour patterns.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, fix technical issues, and develop new features that better serve our Bangladeshi player community.
• Customer Support: Responding to your queries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance.
• Legal Compliance: Meeting our obligations under applicable laws and responding to lawful requests from Bangladeshi governmental or regulatory authorities.
• Responsible Gaming Enforcement: Applying and monitoring deposit limits, session time restrictions, cooling-off periods, and self-exclusion settings that you have activated on your account.
• Marketing Communications (opt-in only): Sending you promotional emails, bonus notifications, or platform updates — but only if you have explicitly opted in to receive such communications. You may withdraw this consent at any time.

4. Data Sharing & Third Parties

khalibet does not sell, rent, or trade your personal data. We share personal data only in the limited, specific circumstances described below, and only to the minimum extent necessary for each purpose.

4.1 Payment Providers

To process your deposits and withdrawals, we share necessary transactional data with our certified payment partners, including bKash, Nagad, Rocket, Upay, and partner banking institutions (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank). Each of these providers operates under its own privacy and data security framework. We share only the data each provider requires to complete the specific transaction.

4.2 Game Providers

Casino games and live dealer tables on khalibet are supplied by third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. These providers may receive your account identifier and session token to initialise your game session. They do not receive your full name, NID, or payment details. Game providers are contractually bound to use session data only for the purpose of delivering the game and do not use it for independent profiling or marketing.

4.3 Technology & Infrastructure Partners

khalibet uses third-party cloud hosting, CDN, and cybersecurity services to operate the platform. These service providers act as data processors on our behalf under strict contractual data processing agreements. They process data only on our documented instructions and are prohibited from using it for their own commercial purposes.

4.4 Legal & Regulatory Authorities

We may disclose personal data to relevant Bangladeshi governmental bodies, law enforcement agencies, or regulatory authorities where we are legally required to do so or where we believe in good faith that disclosure is necessary to prevent fraud, money laundering, or harm to persons. We will, where legally permissible, notify you if your data is the subject of a lawful disclosure request.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of khalibet, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the way your data is handled as a result, by a notice posted prominently on the khalibet platform at least 30 days before the transfer takes effect.

5. Cookies & Tracking Technologies

khalibet uses cookies, local storage, and similar browser-based tracking technologies to operate the platform effectively and to understand how players engage with our services. A cookie is a small text file placed on your device when you visit a website. The cookies we use fall into the following categories:

khalibet does not use third-party advertising cookies or cross-site tracking pixels. You can manage cookie preferences through your browser settings at any time, though disabling strictly necessary or security cookies may impair your ability to log in or use certain platform features. Clearing your browser cookies will end your current session and require you to log in again at your next visit.

6. Data Retention & Storage

khalibet retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the full duration of your account being open and active on the khalibet platform.
• Transaction Records: Retained for a minimum of five (5) years following the date of the transaction, in line with standard financial record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of account closure, or longer if required by a specific legal obligation or ongoing investigation.
• Support Communications: Retained for two (2) years from the date of the last correspondence in the relevant ticket or thread.
• Self-Exclusion Records: Retained for a minimum of seven (7) years from the date the self-exclusion was applied, to prevent circumvention by re-registration.
• Marketing Consent Records: Retained until you withdraw consent, plus an additional 12 months as evidence of your consent history.
• Technical Logs: Retained for a maximum of 90 days for routine debugging, and up to two (2) years where a security incident investigation is ongoing.

All personal data held by khalibet is stored on servers located within secure, access-controlled data centre facilities. Data is backed up regularly. Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with all access events logged and auditable.

7. Your Privacy Rights

As a registered player on khalibet, you have the following rights with respect to your personal data. You may exercise any of these rights by submitting a written request to support@khalibet. We will respond within five (5) business days.

Right of Access

You have the right to request a copy of all personal data that khalibet holds about you, together with information about how that data is used, with whom it is shared, and for how long it is retained. We will provide this information in a structured, readable format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Where the correction relates to your registered name or date of birth, we will require supporting identity documents to verify the change before updating your account.

Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing based on legitimate interests and your interests override ours. Please note that certain data categories — particularly transaction records, KYC documents, and self-exclusion records — cannot be erased before their mandatory retention periods expire.

Right to Restrict Processing

You have the right to request that we temporarily suspend the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data we hold, or while an objection to legitimate-interest processing is being assessed.

Right to Data Portability

For data that you have provided to us directly and that we process on a consent or contractual basis, you have the right to request a machine-readable export of that data so that it can be transferred to another service provider. This right applies primarily to registration data and account preferences.

Right to Object to Marketing

If you have previously consented to receiving marketing communications from khalibet, you may withdraw that consent at any time. To opt out of promotional emails and notifications, you can update your communication preferences in your account settings or include an unsubscribe request in a written email to support@khalibet. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before your withdrawal.

8. Data Security Measures

khalibet takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. Our key security measures include the following:

• 256-bit SSL/TLS Encryption: All data exchanged between your browser or app and our servers is encrypted using TLS 1.3 protocol, the current industry standard for secure web communications.
• Encrypted Data Storage: Sensitive data fields — including passwords (stored as salted hashes), KYC documents, and payment reference numbers — are encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): khalibet offers optional two-factor authentication for all registered accounts. We strongly encourage all players to enable 2FA to add an additional layer of protection to their login process.
• Role-Based Access Controls: Internal access to player data is governed by a strict role-based access control (RBAC) policy. Only personnel with a documented business need may access personal data, and all access is logged and subject to regular audit.
• Intrusion Detection: Our infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous data transfer patterns by automated security systems and our dedicated security team.
• Third-Party Security Audits: khalibet undergoes periodic security assessments to identify and remediate vulnerabilities in our platform and data handling practices.

Despite these measures, no internet-based platform can guarantee absolute security. In the unlikely event of a data breach that affects your personal data, khalibet will notify affected players promptly and take all necessary steps to contain and remediate the incident. We recommend that players use a unique, strong password for their khalibet account and avoid sharing their login credentials with any other person.

9. Updates to This Policy

khalibet reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered players by email to their registered address and by displaying a prominent notice on the platform for at least seven (7) days before the updated policy takes effect.

We encourage you to review this Privacy Policy periodically, particularly before submitting any new personal data or enabling new platform features. The date of the most recent revision is displayed at the top of this document and in the "Last Updated" badge on this page. The version currently published at khalibet/privacy-policy is always the operative version.

Your continued use of the khalibet platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree to the revised policy, you should stop using the platform and request account closure by contacting us at support@khalibet.

This Privacy Policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, which together form the full framework governing your relationship with the khalibet platform.