Privacy Policy

Play Kehla Co., Ltd. ("Kehla", "we", "us", or "our") operates the playkehla.com platform. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over it. By using the Platform you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Platform. This Policy applies to all users of playkehla.com — consumers, venue partners, coaches, and visitors. It does not apply to third-party websites or services linked from our Platform.

We collect information in three ways: Information you provide directly: — Account registration: name, email address, phone number, date of birth, profile photo, and @handle. — Venue partner registration: business name, address, sport types, logo, and banking details for payouts. — Bookings: session selections, payment confirmation references. — Communications: messages you send to our support team. — Reviews: star ratings and written comments you submit. Information collected automatically: — Device and browser information (type, operating system, browser version). — IP address and approximate geolocation (city/district level). — Pages visited, features used, and time spent on the Platform. — Session identifiers and cookies (see Section 8). Information from third parties: — If you connect via Google OAuth, we receive your name and email from Google. — If you connect Telegram, we receive your Telegram chat ID and username. — KHQR payment confirmations via ABA PayWay (we do not receive or store your full banking credentials).

We use your personal data to: — Create and manage your account. — Process bookings and payments, and issue refunds where applicable. — Send booking confirmations, reminders, and cancellation notices via email and Telegram. — Display your profile to other users (subject to your public/private setting). — Show venues and sessions relevant to your location and sport preferences. — Provide venue partners with attendance reports and anonymised usage statistics. — Investigate fraud, abuse, and violations of our Terms of Service. — Respond to support requests. — Comply with legal obligations under Cambodian law. — Improve the Platform through analysis of aggregated, anonymised usage data. We do not use your data to make fully automated decisions that have a legal or similarly significant effect on you without human review.

We process your personal data on the following grounds: — Contract performance: processing necessary to fulfil your booking or our partnership agreement. — Legitimate interests: operating and improving the Platform, preventing fraud, and communicating with you about your account, where these interests are not overridden by your rights. — Legal obligation: where Cambodian law requires us to retain or disclose data. — Consent: for optional features such as Telegram notifications and marketing communications. You may withdraw consent at any time.

We share personal data only as necessary to operate the Platform: Venue partners: when you make a booking, the venue receives your name, booking reference, and QR code. They do not receive your email address, phone number, or payment details unless you provide these directly. Service providers: we use third-party providers to help operate the Platform, including: — Supabase (database and authentication) — Resend (transactional email delivery) — Telegram (notification delivery) — Firebase (push notifications) — Sentry (error monitoring) — Google (authentication, maps) Each provider is contractually required to process data only as instructed and in accordance with applicable privacy law. Legal authorities: we may disclose data to Cambodian law enforcement or regulatory bodies when required by law, court order, or to protect the rights and safety of Kehla, our users, or the public. Business transfers: in the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify affected users before data is transferred and becomes subject to a different privacy policy. We do not sell your personal data to third parties.

All payments are processed via KHQR, Cambodia's national QR payment standard, through ABA PayWay. Kehla generates a KHQR code for each transaction but does not collect, store, or have access to your bank account number, card number, or full financial credentials. We retain transaction records (amount, date, booking reference, payment confirmation reference) for accounting, dispute resolution, and legal compliance purposes for a period of 7 years, as required under Cambodian financial regulations. Venue partners receive payout statements showing gross revenue, Kehla service fees deducted, and net amounts paid. These statements do not include individual consumer identities.

If you choose to connect your Telegram account to Kehla, we store your Telegram chat ID and username to send you booking confirmations, reminders, and account notifications. We send messages only in connection with your bookings and account activity. We do not send marketing messages via Telegram without your separate consent. You can disconnect your Telegram account at any time via Settings → Notifications → Disconnect Telegram. After disconnection, we delete your Telegram chat ID from our systems and send a final confirmation message. If you block @KehlaBot or @KehlaPartner_Bot, Telegram notifies us and we stop attempting to send messages to your account.

We use the following types of cookies: Essential cookies: required for the Platform to function (session management, authentication). These cannot be disabled. Analytics cookies: help us understand how users interact with the Platform (pages visited, features used). These are anonymised and aggregated. You can opt out via your browser settings or our cookie preference centre. We do not use advertising or third-party tracking cookies. You can control cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in.

We retain your personal data for as long as your account is active. If you delete your account: — Profile information is deleted within 30 days. — Booking history and payment records are retained for 7 years for legal and accounting compliance. — Reviews you submitted are anonymised (your name is removed) within 30 days of account deletion. — Notification logs are retained for 90 days, then deleted. If your account is suspended for Terms of Service violations, we may retain data for longer to prevent re-registration and to support any ongoing investigations.

You have the following rights over your personal data: — Access: request a copy of the personal data we hold about you. — Correction: request that inaccurate data be corrected. — Deletion: request deletion of your account and personal data, subject to legal retention requirements. — Portability: receive your data in a structured, machine-readable format. — Objection: object to processing based on legitimate interests. — Withdraw consent: for any processing based on consent (e.g. Telegram notifications, marketing emails), withdraw at any time. To exercise any of these rights, email privacy@playkehla.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include: — Encrypted data transmission (HTTPS/TLS). — Passwords stored using strong one-way hashing. — Access controls limiting which team members can access personal data. — Regular security testing and monitoring via Sentry. No method of transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify affected users as required by applicable law.

The Platform is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact support@playkehla.com and we will delete the account promptly.

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice at least 14 days before they take effect. The updated policy will always be available at playkehla.com/legal/privacy. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights: Play Kehla Co., Ltd. Phnom Penh, Kingdom of Cambodia Email: privacy@playkehla.com Support: support@playkehla.com We aim to respond to all privacy enquiries within 30 days.