kf99 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how kf99 ("kf99", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who register for or use the kf99 online gaming platform accessible at kf99.io. This Policy forms part of the overall legal framework governing your use of kf99, alongside our Terms & Conditions and Responsible Gaming Policy.

kf99 is committed to handling your personal data with the highest standards of transparency, integrity, and security. We collect only the data that is strictly necessary to deliver, maintain, and improve our services. We do not collect data speculatively or retain it beyond the periods required for legitimate operational and legal purposes.

By registering an account with kf99 or by continuing to use the kf99 platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the kf99 platform and should close your account by contacting kf99 support.

2. Data We Collect

kf99 collects personal data through several channels: directly from you when you register an account or use our services, automatically through your interaction with the platform, and from third-party partners such as payment processors and identity verification providers. The categories of personal data we collect include the following:

Data Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, gender, nationality	Registration form, KYC verification
Contact Data	Email address, mobile number, residential address	Registration form, account updates
Verification Data	National ID, passport scan, utility bill, selfie photo	KYC process (identity verification)
Financial Data	Deposit/withdrawal records, transaction IDs, payment method type	Payment gateway integration
Technical Data	IP address, device type, browser type, operating system, session duration	Automatic collection via platform logs
Usage Data	Pages visited, games played, bet amounts, game session history	Platform analytics systems
Communications Data	Support chat transcripts, email correspondence, complaint records	Customer support interactions
Preference Data	Language settings, notification preferences, responsible gaming limits	Account settings panel

kf99 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data (beyond what is required for identity verification), or data concerning health conditions — except where you voluntarily disclose health-related information in the context of a responsible gaming request (such as a self-exclusion application citing a gambling disorder), in which case such data is treated with the strictest confidentiality.

3. How We Use Your Data

kf99 processes your personal data only for specific, lawful purposes. We rely on one or more of the following legal bases for each type of processing activity: contractual necessity (to deliver the services you have signed up for), legitimate interests (to operate a secure and compliant gambling platform), legal obligation (to comply with applicable laws), and consent (for optional communications and analytics).

• Account Creation and Management: We use your identity and contact data to create and maintain your player account, verify your eligibility, and communicate essential account-related information such as password resets, security alerts, and policy updates.
• Identity Verification (KYC): We are obligated to verify the identity and age of all registered players. Verification data is used solely for this purpose and is processed by our certified KYC partner under a strict data processing agreement.
• Transaction Processing: Financial data is used to process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and USDT. We retain transaction records for audit and regulatory compliance purposes.
• Fraud Prevention and Security: Technical and usage data is analysed in real time to detect and prevent fraudulent activity, unauthorised account access, money laundering, and match-fixing. This processing is a legitimate interest of kf99 and is necessary to protect both the platform and our player community.
• Responsible Gaming Compliance: Usage data and responsible gaming preference data are used to monitor player behaviour and enforce any limits, cooling-off periods, or self-exclusions that you have requested. This processing is both contractually necessary and legally mandated.
• Platform Improvement: Aggregated and anonymised usage data is used to analyse player behaviour trends, improve game offerings, optimise the platform interface, and resolve technical issues. No individual player is identifiable from this anonymised dataset.
• Customer Support: Communications data is used to respond to your queries, process complaints, and maintain a record of support interactions for quality assurance purposes.
• Legal and Regulatory Compliance: kf99 may process and disclose your data as required to comply with applicable law, court orders, regulatory instructions, or law enforcement requests.

4. Payment Data

kf99 takes the security of your financial information with the utmost seriousness. All payment transactions on the kf99 platform are processed through certified, PCI-DSS-compliant payment gateway partners. kf99 does not store full debit or credit card numbers, CVV codes, or mobile banking PINs on its own servers at any point during the transaction process.

When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, or Upay, your mobile banking credentials are entered directly into the respective payment provider's secure interface and are never transmitted to or stored by kf99's servers. For Visa and Mastercard transactions, card details are tokenised by our payment gateway partner immediately upon entry, and only a secure token — not the actual card data — is retained for future transaction matching.

For USDT (TRC-20) transactions, kf99 records your wallet address and transaction hash for audit and verification purposes. Cryptocurrency transaction data is subject to the blockchain's inherent public transparency; however, kf99 does not publish or share the link between your wallet address and your kf99 identity with any third party beyond our compliance and anti-money laundering obligations.

• All payment data is transmitted over encrypted connections using TLS 1.2 or higher.
• Transaction records are retained for a minimum of 5 years in accordance with financial record-keeping requirements.
• kf99 may share transaction data with our payment partners to investigate disputed transactions or instances of suspected payment fraud.
• Deposit and withdrawal history is accessible to you at all times through your kf99 account dashboard.

5. Cookies & Tracking Technologies

kf99 uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, and understand how players interact with our games and pages. This section explains the types of cookies we use and the purpose of each.

Cookie Type	Purpose	Retention
Strictly Necessary	Enable core platform functionality: session management, login state, security tokens. Cannot be disabled.	Session / up to 24 hours
Functional	Remember your language preference, display settings, and responsible gaming tool configurations.	Up to 12 months
Analytical	Collect anonymised data on page visits, game sessions, and feature usage to improve the platform. No personally identifiable information is included.	Up to 24 months
Security	Detect and mitigate fraudulent login attempts, bot activity, and account takeover attempts.	Up to 30 days

kf99 does not deploy third-party advertising cookies, retargeting pixels, or cross-site tracking scripts. You may disable non-essential cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in to and use the kf99 platform.

6. Data Sharing & Third Parties

kf99 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Period. We share your data only with the specific categories of third-party partners listed below, and only to the minimum extent necessary to fulfil the stated purpose.

• Payment Partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa/Mastercard processing networks, and USDT gateway providers receive transaction-specific data necessary to process your deposits and withdrawals. These partners are contractually prohibited from using your data for any purpose other than completing the transaction.
• Identity Verification Providers: Our KYC partner receives your identity documents and personal details solely for the purpose of verifying your age and identity. Verification results are returned to kf99 in the form of a pass/fail status; document images are retained by the KYC provider under their own regulated data retention policy.
• Game Software Providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a pseudonymous player identifier (not your name or contact details) to deliver game content and maintain game session integrity.
• Fraud Prevention and Security Services: Technical data including IP addresses and device fingerprints may be shared with fraud detection service providers for the purpose of identifying and blocking malicious activity on the platform.
• Legal and Regulatory Authorities: kf99 will disclose personal data to law enforcement agencies, courts, or regulatory bodies when required to do so by applicable law, court order, or regulatory instruction. We will notify affected players of such disclosures where permitted by law.
• Professional Advisors: Lawyers, auditors, and accountants acting as service providers to kf99 may access personal data on a need-to-know basis, subject to professional confidentiality obligations.

All third-party data processors engaged by kf99 are subject to binding data processing agreements that require them to implement appropriate technical and organisational security measures and to process your data only on kf99's documented instructions.

7. Your Rights Over Your Data

kf99 respects your rights in relation to your personal data. You may exercise any of the following rights at any time by submitting a written request to kf99 support at [email protected]. We will respond to all valid requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you in advance.

• Right of Access: You have the right to request a copy of all personal data that kf99 holds about you. We will provide this in a structured, machine-readable format (JSON or CSV) upon request.
• Right to Rectification: If any personal data held by kf99 is inaccurate or incomplete, you have the right to request that it be corrected. Some data fields (such as date of birth) can only be corrected through the formal KYC re-verification process.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. kf99 will honour this request to the fullest extent possible, subject to our legal obligation to retain certain records (such as financial transaction records and KYC documents) for the periods required by applicable law.
• Right to Restriction of Processing: You may request that kf99 restrict the processing of your data in certain circumstances — for example, while the accuracy of data is being contested or while an objection is being assessed.
• Right to Data Portability: You have the right to receive personal data you have provided to kf99 in a structured, commonly used format, and to request that this data be transmitted to another service provider where technically feasible.
• Right to Object: You may object to kf99's processing of your personal data where such processing is based on legitimate interests. kf99 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

8. Marketing Communications

kf99 sends promotional communications — including bonus offers, seasonal promotions (BPL season, Eid, Pohela Boishakh, IPL), new game announcements, and platform updates — only to players who have explicitly opted in to receive such communications during registration or through their account settings. We use three communication channels for marketing purposes: email, SMS to your registered mobile number, and in-platform notifications.

You may unsubscribe from marketing communications at any time through any of the following methods:

• Clicking the "Unsubscribe" link at the bottom of any kf99 marketing email.
• Replying "STOP" to any kf99 marketing SMS message.
• Updating your notification preferences in the "Account Settings" section of your kf99 account dashboard.
• Contacting kf99 support at [email protected] and requesting removal from all marketing lists.

Please note that even if you opt out of marketing communications, kf99 will continue to send you essential service-related messages such as account security alerts, verification requests, deposit confirmations, and withdrawal notifications. These transactional communications are not subject to marketing opt-out and are necessary for the operation of your account.

9. Data Retention

kf99 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply to the main categories of personal data:

Data Category	Retention Period	Basis
Account & Identity Data	Duration of account + 5 years after closure	Legal and regulatory obligation
KYC Verification Documents	5 years from the date of verification	Anti-money laundering compliance
Financial Transaction Records	7 years from the date of each transaction	Financial record-keeping requirements
Technical & Usage Data	Up to 24 months on a rolling basis	Legitimate interest (fraud prevention, analytics)
Support Communications	3 years from the date of each interaction	Legitimate interest (quality assurance, dispute resolution)
Marketing Preferences	Until opt-out, then 2 years (suppression list)	Consent / legitimate interest (prevent re-contact)

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction methods. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

10. Children & Minors

kf99 is strictly an adult gaming platform. Access to and use of the kf99 platform is prohibited for any person under the age of 21. kf99 does not knowingly collect, process, or store any personal data relating to individuals under the age of 21. Our registration process includes a mandatory date-of-birth field and our KYC verification process independently confirms each player's age before any withdrawal is permitted.

If kf99 becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. Any deposits made to such an account will be returned to the payment source after the completion of verification procedures.

11. Security Measures

kf99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes, but is not limited to, the following measures:

• 256-bit SSL Encryption: All data transmitted between your device and the kf99 platform is encrypted using TLS 1.2 or TLS 1.3 protocols, ensuring that your personal and financial data cannot be intercepted in transit.
• Encrypted Data Storage: Personal data stored in kf99's databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised systems and personnel only.
• Access Controls: Internal access to player data is granted on a strict need-to-know basis. All internal data access is role-based, time-limited, and comprehensively logged for audit purposes.
• Two-Factor Authentication: kf99 recommends and supports two-factor authentication (2FA) for player accounts. 2FA significantly reduces the risk of unauthorised account access in the event that your login credentials are compromised.
• Real-Time Threat Monitoring: kf99 employs continuous automated monitoring of platform traffic and account activity to detect anomalies indicative of fraud, brute-force attacks, or account takeover attempts. Suspicious activity triggers immediate automated blocks and manual review.
• Regular Security Audits: kf99's platform and infrastructure undergo regular independent security assessments, penetration testing, and vulnerability scans to identify and remediate potential weaknesses before they can be exploited.
• Staff Training: All kf99 personnel who handle personal data undergo mandatory data protection and information security training. Staff are subject to strict confidentiality obligations enforced through their employment contracts.
• Incident Response: In the event of a data security incident that poses a risk to your personal data, kf99 has a documented incident response plan in place. Affected players will be notified without undue delay, and steps will be taken immediately to contain and remediate the incident.

12. Policy Updates

kf99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the evolution of our platform and services. When we make material changes to this Policy, we will notify registered players via email to the address on file and by displaying a prominent notice on the kf99 platform for a period of not less than 14 days prior to the changes taking effect.

The "Effective Date" at the top of this Policy will be updated each time the Policy is revised. We encourage you to review this page periodically to stay informed about how kf99 protects your personal data. Your continued use of the kf99 platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

If any proposed change is materially adverse to your rights, you have the right to close your account before the revised Policy takes effect. To close your account, please contact kf99 support at [email protected] with the subject line "Account Closure Request".