Privacy Policy — How pajok Protects Your Data

Introduction

pajok is an online betting and gaming platform serving players primarily based in Bangladesh. We are committed to protecting the personal information of everyone who interacts with our platform, whether as a registered member or as a visitor browsing our publicly accessible pages. This Privacy Policy sets out in plain and formal terms how we manage personal data across the full lifecycle of the member relationship — from initial registration through to account closure.

This policy should be read alongside the pajok Terms & Conditions and Responsible Gaming policy, both of which incorporate this Privacy Policy by reference. In the event of any conflict between this policy and a provision in the Terms & Conditions, the Terms & Conditions shall prevail except in matters that relate specifically and exclusively to data privacy, where this policy governs.

pajok operates as an offshore platform. While our primary audience is based in Bangladesh, our data handling practices are designed to meet internationally recognised standards for data protection and information security, including principles commonly associated with modern privacy frameworks.

Personal Data We Collect

We collect personal data in several ways: directly from you when you register or interact with the platform, automatically through your use of the site, and from third parties in limited circumstances (such as identity verification providers). The categories of data we collect include the following:

2.1 Registration & Account Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Bangladeshi mobile number (used for account verification and SMS 2FA)
• Email address (used for account communications and security alerts)
• Username and encrypted password hash
• Residential address (collected during KYC verification)

2.2 Identity Verification (KYC) Data

• Copies of government-issued identity documents — National ID (NID) card, passport, or driving licence
• Proof of address documentation (utility bill, bank statement dated within 90 days)
• Selfie or liveness-check image where required for enhanced verification

2.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment channel used (bKash, Nagad, Rocket, Upay, bank transfer)
• Transaction reference numbers and payment processor confirmation codes
• Account balance history and wagering activity records
• Mobile financial service (MFS) account numbers associated with deposits and withdrawals (masked after verification)

2.4 Usage & Technical Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Pages visited, time on site, click-path data, and session duration
• Game history: games played, bet amounts, results, session timestamps
• Error logs and crash reports where applicable

2.5 Communications Data

• Records of live chat transcripts between you and the pajok support team
• Email correspondence sent to or received from [email protected]
• Responses to optional surveys or feedback requests

2.6 Responsible Gaming Data

• Deposit limit preferences set by you in your account settings
• Self-exclusion status and duration if a self-exclusion has been requested
• Session time reminder preferences
• Any disclosures made to the support team regarding problem gambling

How We Use Your Personal Data

pajok uses the personal data we collect for the following purposes:

• Account creation and management: To register your account, verify your identity and age, manage your preferences, and maintain your account in good standing.
• Service delivery: To process deposits and withdrawals, record betting activity, calculate winnings, and deliver all platform features to which you are entitled as a registered member.
• KYC and compliance: To verify your identity in accordance with anti-money laundering (AML) obligations, confirm your age meets the 21+ minimum, and satisfy any applicable regulatory reporting requirements.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Customer support: To respond to your enquiries, resolve disputes, and provide technical or account assistance through live chat and email channels.
• Responsible gaming: To administer deposit limits, self-exclusion periods, session reminders, and other responsible gaming tools you have activated on your account.
• Platform improvement: To analyse aggregated usage data, identify technical issues, improve the platform's performance and user experience, and develop new features.
• Marketing communications: To send you promotional offers, bonus notifications, and updates about new features — subject to your communication preferences and the opt-out rights described in Section 13 of this policy.
• Legal obligations: To comply with applicable legal obligations, respond to lawful requests from authorities, and defend pajok's legal rights in connection with any dispute.

Legal Basis for Processing

pajok processes your personal data on one or more of the following legal grounds depending on the specific processing activity involved:

• Contractual necessity: Processing that is necessary to perform the contract between you and pajok — principally the account registration and betting services described in the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable legal requirements, including AML/KYC verification obligations and record-keeping requirements under financial regulations.
• Legitimate interests: Processing that is necessary for pajok's legitimate operational interests — including fraud prevention, platform security, internal analytics, and service improvement — provided those interests are not overridden by your privacy rights.
• Consent: Where we rely on consent as the legal basis (primarily for direct marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Third Parties

pajok does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited and controlled circumstances:

5.1 Payment Processors

To process deposits and withdrawals, we share the minimum necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, and partner banking institutions. These providers process data solely for payment execution purposes and are bound by their own data protection obligations.

5.2 Identity Verification Providers

pajok uses third-party KYC and identity verification providers to assist with document verification and liveness checks where applicable. These providers receive KYC document data solely for the purpose of returning a verification result to pajok and are contractually prohibited from retaining or using that data for any other purpose.

5.3 Game Content Providers

Game studios whose products are hosted on the pajok platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive a limited session token and account identifier to authenticate your game session. These providers do not receive your full personal profile or financial data beyond what is necessary to operate the game session.

5.4 Analytics and Infrastructure Providers

pajok uses cloud infrastructure and analytics services to operate and monitor the platform. Providers in this category may have incidental access to certain technical data (such as server logs containing IP addresses) in the course of providing their services. Such providers are bound by data processing agreements limiting their use of data to service delivery only.

5.5 Legal and Regulatory Disclosures

pajok may disclose personal data to law enforcement authorities, regulatory bodies, or other governmental agencies where required to do so by applicable law, court order, or in connection with the prevention or investigation of crime — including but not limited to financial crime and match-fixing investigations. Where permitted by law, pajok will endeavour to notify you of such disclosures.

Cookies & Tracking Technologies

pajok uses cookies and similar tracking technologies to operate the platform, maintain session state, and improve the user experience. The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing identifiers. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, responsible gaming reminder intervals, and recent game selections to personalise your experience on return visits.
• Analytical cookies: Used to collect aggregated, anonymised data about how visitors interact with the platform — including pages viewed, session duration, and navigation paths. This data helps pajok identify usability improvements and technical issues.
• Security cookies: Used to detect and prevent fraudulent or abusive access patterns, including bot traffic, credential-stuffing attempts, and anomalous login behaviour.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of some platform features. pajok does not use third-party advertising cookies or behavioural targeting cookies that track your activity across other websites.

Data Security

pajok implements a layered approach to data security designed to protect your personal information from unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• Encryption in transit: All data transmitted between your device and pajok's servers is encrypted using TLS 1.2 or higher (HTTPS). Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Personal data and financial records stored in pajok's databases are encrypted at rest using AES-256 encryption.
• Password security: Member passwords are never stored in plaintext. They are hashed using a strong one-way hashing algorithm (bcrypt) with per-user salting before being stored.
• Access controls: Access to personal data systems is restricted to authorised personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication for internal systems access.
• Security monitoring: pajok's infrastructure is monitored continuously for anomalous activity, intrusion attempts, and other indicators of compromise. Security incidents are investigated and addressed in accordance with our internal incident response procedures.
• Two-factor authentication (2FA): Members are strongly encouraged to enable SMS-based 2FA on their accounts. When 2FA is active, account access requires both your password and a one-time code sent to your registered Bangladeshi mobile number.

While pajok employs significant technical and organisational safeguards, no digital platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, pajok will notify affected members without undue delay in accordance with applicable obligations.

Data Retention

pajok retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any applicable legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and registration data: Retained for the duration of your active account plus a minimum of 5 years following account closure, in compliance with financial record-keeping obligations.
• KYC / identity verification documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later, in accordance with AML compliance requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Customer support communications: Retained for 2 years from the date of the most recent communication in a given support thread.
• Technical and usage logs: Retained for a rolling 12-month period unless a specific log entry is required to be retained longer in connection with a security investigation or legal dispute.
• Marketing preferences and consent records: Retained for the duration of your account plus 2 years following account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an individual. Where anonymised data is retained for statistical or analytical purposes, it is no longer considered personal data and is not subject to this policy.

Your Data Rights

Subject to applicable law and certain conditions, you have the following rights with respect to the personal data pajok holds about you. To exercise any of these rights, please contact the support team via live chat or email at [email protected] with the subject line "Data Rights Request". pajok will respond to verified requests within 30 calendar days.

Children and Minors

pajok's services are strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. The platform employs age verification procedures during registration and KYC review to enforce this requirement.

If pajok becomes aware that personal data has been collected from a person under the age of 21, the account will be closed immediately, all associated funds will be reviewed under our minor-protection procedures, and the personal data will be securely deleted in accordance with applicable obligations. If you are a parent or guardian and believe that a minor has registered an account with pajok, please contact our support team immediately via live chat.

Third-Party Links

The pajok platform may from time to time contain references to third-party game providers or payment services. While pajok takes care to work only with reputable partners, we have no control over and accept no responsibility for the privacy practices or content of any third-party websites, applications, or services that may be accessible in connection with the platform.

This Privacy Policy applies solely to data collected and processed by pajok through the pajok.io platform and associated communications channels. If you follow a link to a third-party service, we encourage you to review that service's privacy policy before providing any personal information.

International Data Transfers

pajok operates as an offshore platform. As a result, personal data collected from members based in Bangladesh may be transferred to, stored on, and processed by servers or service providers located in jurisdictions outside Bangladesh. Such transfers are carried out subject to appropriate safeguards designed to ensure that your data receives a comparable level of protection to that which would apply in Bangladesh.

Safeguards used by pajok for international transfers include contractual data processing agreements with all third-party processors that incorporate data protection obligations consistent with internationally recognised standards. Where you have questions about the specific safeguards in place for a particular transfer, you may direct those enquiries to [email protected].

Marketing Communications

With your consent, pajok may send you promotional communications relating to new features, bonuses, seasonal promotions (for example, tied to BPL, Eid, or Pohela Boishakh), and other platform news via SMS to your registered Bangladeshi mobile number and via email to your registered address.

You can opt out of marketing communications at any time using any of the following methods:

• Updating your communication preferences in your account settings under the "Notifications" section.
• Clicking the unsubscribe link included in any marketing email you receive from pajok.
• Contacting live chat support and requesting removal from the marketing list.
• Emailing [email protected] with the subject line "Marketing Opt-Out".

Opting out of marketing communications will not affect transactional or service-related communications — these include account security alerts, deposit/withdrawal confirmations, KYC status updates, and responsible gaming notifications, all of which are necessary for the safe operation of your account and cannot be disabled.

Changes to This Privacy Policy

pajok reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page.
• Notify active members via in-platform messaging or email where the changes significantly affect how we process your personal data.
• Where required by law, seek your renewed consent before processing your data under the revised terms.

Your continued use of the pajok platform after a revised Privacy Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any changes, your remedy is to close your account and cease using the platform, subject to the withdrawal of any verified eligible balance.

We encourage you to review this Privacy Policy periodically so you remain informed about how we protect your data. The most current version of this policy is always available at pajok.io/privacy-policy.

Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or pajok's data handling practices, please reach out through the following channels:

• Live Chat: Available 24/7 directly on the pajok platform — the fastest channel for privacy-related enquiries and data rights requests.
• Email: [email protected] (plain text — not a link). Use subject line "Privacy Enquiry" for general questions or "Data Rights Request" when exercising a specific right. Responses are targeted within 24 hours during Bangladesh Standard Time (UTC+6) business hours.

All data rights requests will be responded to within 30 calendar days of receipt of a verified request. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.