Privacy Policy — How newpklack Protects Your Data

Information You Provide Directly

• Registration data: When you create a newpklack account, we collect your chosen username, a registered Bangladeshi mobile telephone number, your date of birth, and a hashed version of your chosen password. We never store your password in plaintext.
• KYC documents: Before processing your first withdrawal, we require a government-issued identity document (National ID Card, passport, or driving licence) and, in some cases, a utility bill or bank statement as proof of address. These documents are used exclusively for age and identity verification.
• Payment information: When you make a deposit or request a withdrawal, we collect the mobile financial service number (bKash, Nagad, Rocket, or Upay) or card details (Visa, Mastercard) associated with the transaction. Full card numbers are never stored on newpklack servers — they are handled by our PCI-DSS compliant payment processors.
• Support communications: If you contact our support team at [email protected], we retain the content of your message and any attachments for as long as is necessary to resolve the query and for a reasonable period thereafter for quality and audit purposes.
• Responsible gaming self-declarations: If you voluntarily set a deposit limit, request a cooling-off period, or initiate self-exclusion, we record those preferences and the dates on which they were set or modified.

Information Collected Automatically

• Device and browser data: We automatically collect your IP address, device type, operating system version, browser type and version, screen resolution, and preferred language setting each time you access the Platform.
• Session and activity logs: We record the pages and game sections you visit, the duration of each session, the games you play, the wagers you place, and the outcomes of those wagers. This data is used for fraud detection, responsible gaming monitoring, and platform improvement.
• Geolocation data: We collect your approximate geographic location (derived from your IP address) to ensure compliance with our jurisdictional access policies and to deliver locally relevant content. We do not collect precise GPS coordinates.
• Cookie and tracking data: We use session cookies, persistent preference cookies, and aggregate analytics identifiers as described in the Cookies section below. No cross-site advertising cookies are deployed on newpklack.

Service Providers & Processors

• Payment processors: We share transaction data with our mobile financial service partners (bKash, Nagad, Rocket, Upay) and card payment processors (Visa, Mastercard acquiring banks) to execute your deposit and withdrawal instructions. These partners receive only the data strictly necessary to complete each transaction.
• KYC and identity verification providers: Your identity documents are shared with our third-party KYC verification service for the sole purpose of confirming your age and identity. This partner operates under a strict data processing agreement and may not use your documents for any other purpose.
• Game studio providers: When you play games from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, your in-game activity data is processed by those studios' own systems. Each studio operates under its own applicable privacy and data security standards as required by their certifications.
• Fraud and risk analytics partners: Aggregated, pseudonymised behavioural signals may be shared with fraud-detection service providers to identify and block suspicious activity. These partners do not receive your name, mobile number, or payment account details.

Legal & Regulatory Disclosures

• newpklack will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by a valid court order, regulatory direction, or applicable law — including obligations under anti-money-laundering legislation.
• In the event of a business restructuring, merger, or acquisition, your personal data may be transferred to the successor entity, subject to the same privacy protections set out in this policy. You will be notified of any such transfer via the Platform prior to it taking effect.
• Where we have a good-faith belief that disclosure is necessary to prevent imminent harm to a player or third party (for example, in a safeguarding context), we may share relevant information with appropriate emergency services or support organisations.

Security Measures

• All data in transit between your device and newpklack servers is encrypted using TLS 1.2 or higher. Older, insecure protocols (SSL 3.0, TLS 1.0, TLS 1.1) are disabled site-wide.
• Passwords are stored using a one-way, salted cryptographic hash function. newpklack staff cannot read your password in any form, and you will never be asked for your password by our support team.
• KYC documents and identity files are stored in an encrypted, access-controlled environment. Access is restricted to a small number of authorised compliance personnel and is logged for audit purposes.
• Payment card data is handled exclusively by PCI-DSS Level 1 certified payment processors. newpklack does not store full card numbers, CVV codes, or card expiry dates on its own servers.
• Production systems are protected by firewalls, intrusion detection systems, and regular independent security assessments. Critical vulnerabilities are patched on a priority basis.
• Two-factor authentication (2FA) via SMS OTP is available to all players and is mandatory for withdrawals above ৳10,000.

Data Retention Periods

• Active account data: Retained for the lifetime of your account plus a minimum of five years after account closure, to meet AML record-keeping requirements.
• KYC documents: Retained for five years from the date of verification or from the date of account closure, whichever is later, in compliance with applicable financial regulations.
• Transaction records: Retained for a minimum of five years from the date of each transaction to support AML compliance, dispute resolution, and audit trails.
• Support communications: Retained for two years from the date of the last message in the support thread, unless the subject matter relates to a dispute or regulatory investigation, in which case retention is extended until resolution.
• Analytics data: Aggregated and anonymised after 24 months. Once anonymised, the data no longer constitutes personal data and is retained indefinitely for platform improvement purposes.
• Self-exclusion records: Retained permanently to prevent re-registration during an active exclusion period and to support responsible gaming audit obligations.