topkoro Privacy Policy

1.1 Data Provided Directly by You

When you register an account, verify your identity, make a deposit or withdrawal request, or contact our support team, you provide us with personal data directly. This includes:

• Identity data: Full legal name, date of birth, national identity card (NID) number, passport number, or driving licence number (as provided for KYC verification).
• Contact data: Email address, mobile phone number, and residential address in Bangladesh (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar).
• Financial data: bKash account number, Nagad account number, Rocket account number, Upay account number, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank account details, or Visa/Mastercard details used to fund your topkoro account. Note that full card numbers are never stored on topkoro's servers — payment data is handled by our payment processing partners.
• Account credentials: Your chosen username and an encrypted hash of your password. topkoro never stores your password in plain text.
• Support correspondence: The content of messages, complaints, or queries you submit to the topkoro support team via email or live chat.

1.2 Data Collected Automatically

When you use the topkoro platform, certain technical data is collected automatically by our systems:

1.3 Data from Third Parties

In certain circumstances, topkoro may receive personal data about you from third parties, including:

• KYC verification providers: Third-party identity verification services may confirm or supplement the identity data you provide during registration.
• Payment processors: Our payment partners (including bKash, Nagad, Rocket, and Upay gateway processors) may share transaction confirmation data with topkoro to reconcile deposits and withdrawals.
• Fraud and AML screening services: topkoro uses specialist third-party screening services to identify high-risk accounts and potentially fraudulent activity. These services may share risk scores or flags with topkoro.
• Affiliate partners: If you arrived at topkoro through an affiliate referral link, the affiliate may share a unique referral identifier with topkoro. No sensitive personal data is shared by affiliates.

3.1 Categories of Third-Party Recipients

topkoro may share your personal data with the following categories of third parties:

• Payment processors: bKash, Nagad, Rocket, Upay, and bank transfer processors receive the minimum data necessary to process your transactions. These partners are bound by their own privacy and security standards.
• Identity verification providers: Third-party KYC services receive your identity documents and personal details solely for the purpose of verifying your identity in accordance with our compliance obligations.
• Game content providers: Where you play games provided by studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, limited session data (such as your player ID and bet history within those games) is shared with the relevant provider's game server for the purpose of running the game. These providers operate under strict data processing agreements with topkoro.
• Fraud prevention and AML screening services: Specialist third-party providers receive limited identity and transaction data for the purpose of generating risk assessments. topkoro uses these assessments to make account and withdrawal decisions.
• IT and infrastructure providers: topkoro uses third-party cloud hosting, database management, and security monitoring services. These providers process data on topkoro's behalf under strict contractual terms and may not use the data for their own purposes.
• Legal and regulatory authorities: In cases where topkoro is required by law, court order, or regulatory instruction to disclose personal data, we will comply with that obligation and, where legally permitted, notify the affected player.

3.2 No Sale of Personal Data

topkoro does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We will never share your data with advertising networks, data brokers, or social media companies for the purpose of targeting you with third-party advertisements.

3.3 International Data Transfers

Some of topkoro's third-party service providers operate infrastructure outside Bangladesh. Where your personal data is transferred to a third country, topkoro takes steps to ensure that such transfers are subject to appropriate safeguards — including contractual protections that require the recipient to process your data to standards equivalent to those described in this Privacy Policy.

5.1 Retention Periods

The following general retention periods apply to the categories of personal data topkoro holds:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five years following permanent account closure, to satisfy AML record-keeping obligations.
• Transaction data: All financial records — including deposit history, withdrawal history, and bet records — are retained for a minimum of five years from the date of each transaction.
• KYC documentation: Identity and address verification documents are retained for five years after the date of verification or account closure, whichever is later.
• Support correspondence: Records of support interactions are retained for three years from the date of the final communication in each case.
• Marketing preferences: Records of your consent to or opt-out from promotional communications are retained for as long as your account is active and for three years thereafter.
• Technical and usage logs: Server logs and session data are retained for up to 13 months for security and analytical purposes, after which they are deleted or anonymised.

5.2 Deletion and Anonymisation

When the applicable retention period for a category of personal data expires, topkoro will either securely delete the data or anonymise it so that it can no longer be associated with an individual player. Anonymised data may be retained indefinitely for statistical and analytical purposes. Deletion requests submitted by players (see Section 6) will be honoured within the constraints of applicable legal retention obligations — we cannot delete data that we are legally required to retain.

7.1 Technical Safeguards

All data transmitted between your device and the topkoro platform is encrypted using Transport Layer Security (TLS) with a valid SSL certificate. Passwords are stored using a one-way cryptographic hash — topkoro staff cannot read your password. Payment card data is tokenised by our payment processing partners and is never stored on topkoro's own servers. Access to topkoro's internal systems and databases is controlled by role-based access permissions, multi-factor authentication for administrative accounts, and comprehensive audit logging.

7.2 Organisational Safeguards

topkoro limits access to personal data to those staff members and contractors who genuinely need it to perform their role. All personnel with access to player data are subject to strict confidentiality obligations. topkoro conducts regular internal reviews of its data handling practices and trains relevant staff on data protection responsibilities.

7.3 Data Breach Response

In the event that topkoro discovers a personal data breach that poses a risk to affected players, topkoro will take immediate steps to contain the breach, assess the scope and impact, and notify affected players without undue delay. Breach notifications will be sent to your registered email address in English and will include a clear description of the nature of the breach, the data affected, the likely consequences, and the steps topkoro has taken or will take to address it.

7.4 Your Responsibility

While topkoro takes comprehensive measures to protect your data on its end, you also play an important role in keeping your account secure. You should choose a strong, unique password for your topkoro account, never share your login credentials with anyone, log out of your account when using a shared or public device, and contact topkoro immediately if you suspect any unauthorised access to your account.