kd999 Privacy Policy —
How We Protect Your Data

1. Introduction

This Privacy Policy ("Policy") describes how kd999 ("kd999", "we", "us", "our") collects, uses, stores, discloses, and protects personal information that you ("Player", "User", "you") provide when you access or use the kd999 online casino and sports betting platform available at kd999.io and any associated mobile interfaces or services (collectively, the "Platform").

kd999 is committed to handling your personal information with integrity, transparency, and care. We recognise that Bangladeshi players trust us with sensitive personal and financial data, and we take that responsibility seriously. This Policy is designed to give you a clear, honest account of our data practices so you can make informed decisions about your use of the kd999 Platform.

This Privacy Policy should be read together with the kd999 Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. Capitalised terms not defined in this Policy carry the meaning assigned to them in the Terms & Conditions.

This Policy was last updated on 1 January 2026 and supersedes all prior versions. We encourage you to review this page periodically to stay informed of any updates.

2. Definitions

For clarity throughout this Policy, the following terms have the meanings given below:

• "Personal Data" means any information that identifies or could reasonably be used to identify you as an individual, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, modification, retrieval, and deletion.
• "Data Controller" means kd999, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of kd999 under a data processing agreement.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, remember preferences, and collect usage analytics.
• "KYC Documents" means identity verification documents such as National ID Cards, passports, utility bills, and bank statements submitted by Players for age and identity verification.
• "Sensitive Data" means Personal Data that warrants enhanced protection, including financial information, identity documents, and any health-related information you choose to share in the context of responsible gaming requests.

3. Personal Data We Collect

kd999 collects Personal Data in the following categories depending on how you interact with the Platform:

3.1 Registration Data

When you create a kd999 Account, we collect: your full legal name, date of birth, residential address in Bangladesh, email address, and Bangladeshi mobile phone number. This data is essential to create and manage your Account.

3.2 Identity Verification (KYC) Data

To comply with age verification and anti-money-laundering obligations, we may collect copies of your government-issued National ID Card (NID), passport, or driving licence; a proof of address document (utility bill or bank statement dated within three months); and proof of payment method ownership where required.

3.3 Financial and Transaction Data

We collect records of all deposits, withdrawals, Wagers, winnings, and bonus transactions associated with your Account. We also collect the payment method identifiers you use (for example, the bKash or Nagad wallet number, or the last four digits of a bank card) — we do not store full card numbers or mobile banking PINs.

3.4 Usage and Behavioural Data

We automatically collect data about how you use the Platform, including pages visited, games played, session duration, bet history, device type, operating system, browser type, IP address, and general geographic location (country/city level, derived from IP).

3.5 Communication Data

When you contact our support team via live chat or email, we retain records of those conversations to provide support, resolve disputes, and improve service quality. If you opt in to marketing communications, we record that consent and the communications sent.

3.6 Responsible Gaming Data

If you use responsible gaming tools such as deposit limits, self-exclusion, or cooling-off periods, we record the activation, duration, and settings of those tools. This data is processed with heightened care and is not used for marketing purposes.

4. How We Collect Your Data

kd999 collects Personal Data through the following means:

• Directly from you: when you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey or promotion.
• Automatically: through cookies, web beacons, server logs, and similar tracking technologies when you browse kd999.io or use the Platform.
• From payment providers: transaction confirmation data from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners when you make a deposit or withdrawal.
• From identity verification services: confirmation or flag data from third-party KYC service providers used to verify your identity documents.
• From fraud prevention services: device fingerprint data, risk scores, and flagging data from fraud detection partners used to protect the Platform from misuse.

5. How We Use Your Personal Data

kd999 uses your Personal Data for the following purposes:

Purpose	Data Used
Creating and managing your Account	Registration data, KYC data
Processing deposits and withdrawals	Financial data, KYC data
Providing customer support	Communication data, Account data
Verifying age and identity (KYC/AML)	KYC documents, registration data
Detecting and preventing fraud	Usage data, financial data, device data
Responsible gaming monitoring	Behavioural data, responsible gaming data
Sending account notifications	Registration data, communication data
Sending marketing communications (opt-in only)	Registration data, communication data
Improving Platform features and UX	Usage and behavioural data (anonymised)
Complying with legal obligations	All categories as required by law

kd999 does not use automated decision-making processes that produce legal or similarly significant effects on Players without human review. Responsible gaming monitoring flags are reviewed by our Trust & Safety team before any Account restriction is applied.

6. Legal Basis for Processing

kd999 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing your registration data, KYC documents, and financial data is necessary to enter into and perform our agreement with you (the Terms & Conditions). Without this processing, we cannot provide the kd999 service to you.
• Legal obligation: We are required to process certain categories of data to comply with age verification obligations, anti-money-laundering requirements, and fraud prevention duties.
• Legitimate interests: We process usage and behavioural data to improve the Platform, detect fraud, and maintain security, where those interests are not overridden by your privacy rights.
• Consent: We send marketing emails, SMS, and push notifications only where you have given explicit, freely given consent. You may withdraw this consent at any time via the unsubscribe link in any marketing communication or by contacting [email protected].

7. Data Sharing and Disclosure

kd999 does not sell your Personal Data. We may share your data with the following categories of third parties, and only to the extent necessary for the stated purpose:

7.1 Payment Processors

To facilitate deposits and withdrawals, we share relevant transaction data with your chosen payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank). These providers process data under their own privacy policies and applicable financial regulations.

7.2 Game Content Providers

To deliver live casino, slot, and sports betting content, we share a session token and anonymised player identifier with our licensed game studio partners (including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe). These providers do not receive your full name, NID, or payment details.

7.3 Identity Verification Services

To complete KYC checks, we may share document images and registration data with accredited third-party identity verification providers. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose other than identity verification for kd999.

7.4 Fraud Prevention and Security Services

We share device identifiers, IP addresses, and behavioural data with fraud detection and cybersecurity partners to identify and prevent fraudulent activity, bonus abuse, and unauthorised access.

7.5 Legal and Regulatory Disclosure

kd999 may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid legal process, or to protect the rights, property, or safety of kd999, its players, or third parties.

7.6 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of kd999's assets, Player Personal Data may be transferred to the acquiring entity. We will notify affected Players via registered email prior to any such transfer and give them the opportunity to request Account closure.

8. Cookies and Tracking Technologies

kd999 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, lobby layout, and previously visited game categories to personalise your experience.
• Analytics cookies: Collect anonymised data about how Players navigate the Platform (page views, session duration, exit pages) to help us identify and fix usability issues. This data is aggregated and cannot identify you individually.
• Fraud prevention cookies: Assign a device fingerprint to help detect multiple accounts, automated tools, and other fraudulent behaviour patterns.

kd999 does not use third-party advertising cookies or behavioural targeting pixels. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform.

9. Data Retention

kd999 retains your Personal Data for as long as your Account remains active and for a period thereafter as required by our legal obligations or as necessary to resolve disputes. The following retention guidelines apply:

• Account and registration data: Retained for the duration of your Account plus a minimum of 5 years after Account closure, to comply with AML record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of verification, in line with financial crime prevention standards.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Support communications: Retained for 2 years from the date of the last communication, unless they relate to an unresolved dispute.
• Marketing consent records: Retained for the duration of your opt-in plus 2 years after withdrawal of consent, as evidence of lawful marketing.
• Responsible gaming records: Retained for the duration of your self-exclusion or restriction period plus 5 years, to prevent circumvention of self-exclusion.
• Analytics data (anonymised): Retained indefinitely in aggregated, non-identifiable form for Platform improvement purposes.

After the applicable retention period has elapsed, Personal Data is securely deleted or irreversibly anonymised.

10. Data Security

kd999 implements a multi-layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption at rest for all Sensitive Data stored in our databases, including KYC documents and financial records.
• Role-based access controls ensuring that kd999 staff can only access Personal Data necessary for their specific job function.
• Multi-factor authentication required for all internal systems that process Personal Data.
• Regular third-party security audits and penetration testing of the kd999 infrastructure.
• Incident response procedures including player notification protocols in the event of a confirmed data breach.

While kd999 takes all reasonable precautions to secure your data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your Account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your Account.

11. Your Privacy Rights

As a kd999 player, you have the following rights over your Personal Data:

• Right of access: You may request a copy of all Personal Data kd999 holds about you. We will provide this within 30 calendar days of receiving a verified request.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. Contact support to update your registered details.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Note that AML obligations may prevent full deletion of transaction and KYC records within the mandatory retention period.
• Right to restrict processing: You may request that we temporarily suspend processing of your data while a dispute or correction request is being resolved.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you have provided to kd999 directly.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to object: You may object to processing based on legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.

To exercise any of the above rights, please contact our Data Protection team at [email protected] with the subject line "Data Privacy Request — [Your Right]". We will verify your identity before processing any data rights request. We aim to respond to all requests within 30 calendar days; complex or high-volume requests may require up to 60 days, and we will inform you if an extension is needed.

12. Children's Privacy and Underage Access

The kd999 Platform is strictly intended for adults aged 21 and above. kd999 does not knowingly collect Personal Data from anyone under the age of 21. If you are a parent or guardian and believe that a person under 21 has registered a kd999 Account or submitted Personal Data to the Platform, please contact us immediately at [email protected]. We will investigate and, where confirmed, immediately close the Account and securely delete all associated Personal Data.

kd999 employs age gate prompts at registration, KYC document verification, and ongoing behavioural monitoring to minimise the risk of underage access. We encourage parents and guardians to make use of parental control and web filtering software to prevent access to gambling platforms by persons under 21.

13. Third-Party Links and Services

The kd999 Platform may contain links to third-party websites or services (for example, payment provider portals or game studio help pages). This Privacy Policy applies solely to the kd999 Platform at kd999.io. kd999 is not responsible for the privacy practices of any third-party website or service. We encourage you to read the privacy policy of every third-party service you visit. Any data you provide directly to a third-party service is governed by that service's own privacy policy, and kd999 accepts no liability for how those third parties handle your data.

14. Changes to This Privacy Policy

kd999 reserves the right to update this Privacy Policy at any time. When we make material changes — for example, changes to the categories of data we collect, new data sharing arrangements, or changes to retention periods — we will notify you by: (a) posting a prominent notice on the kd999 Platform homepage; and (b) sending an email notification to your registered email address at least 14 calendar days before the changes take effect.

The revised Policy will take effect on the date stated in the notification. Your continued use of the kd999 Platform after the effective date constitutes acceptance of the updated Policy. If you do not accept the revised Policy, you must cease using the Platform and may request Account closure by contacting [email protected] before the effective date.

For minor, non-material changes (such as typographical corrections or clarifications that do not alter our data practices), we will update this page without individual notification. The "Last Updated" date at the top of this page will always reflect the most recent revision.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or kd999's data practices, please contact our Data Protection team using the details below. All privacy enquiries are treated as confidential and are handled by a dedicated team member, not an automated system.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Data Privacy Request — [Nature of Request]"
• Support hours: 24 hours a day, 7 days a week
• Language: English
• Response time: Under 2 hours for standard queries; up to 30 days for formal data rights requests
• Time zone: Bangladesh Standard Time (BST, UTC+6)

For urgent matters relating to suspected unauthorised access to your Account or a potential data security incident, please mark your email subject line as "URGENT — Security Incident" to ensure immediate escalation to the kd999 Trust & Safety team.