Privacy Policy — How kui99 Protects Your Personal Data

1. Data Controller Identity

For the purposes of this Privacy Policy, the data controller responsible for the personal information collected through the kui99 Platform is the operator of https://kui99.com, referred to throughout this document as "kui99", "we", "us", or "our". References to "you", "your", or "the Player" refer to any individual who accesses, browses, registers on, or transacts through the kui99 Platform.

The kui99 Platform is designed and operated specifically for players in Bangladesh. All data processing activities described in this policy are conducted with the Bangladesh market in mind, and our data handling practices are aligned with widely recognised principles of data protection including purpose limitation, data minimisation, storage limitation, and integrity and confidentiality.

If you have any questions about how kui99 handles your personal data, or if you wish to exercise any of the rights described in this policy, you may contact our privacy team at [email protected]. We aim to respond to all privacy-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6).

2. Personal Data We Collect

kui99 collects personal data through several channels: directly from you when you register an account or contact support, automatically when you use the Platform, and in some cases from third-party identity verification and payment service providers. We collect only the minimum data necessary for each purpose.

Data you provide directly to kui99:

• Full legal name as it appears on your government-issued identification;
• Date of birth (used for age verification — you must be 18 or older);
• Residential address in Bangladesh (city, district, and full postal address);
• Valid email address;
• Bangladesh mobile phone number;
• Chosen username and hashed password (passwords are never stored in plain text);
• Identity documents submitted during KYC — National Identity Card (NID), passport, or driving licence;
• Proof-of-address documents such as utility bills or bank statements;
• Payment account details including bKash, Nagad, Rocket, or Upay mobile wallet numbers and bank account references (card numbers are handled by PCI-DSS compliant payment processors and are never stored on kui99 servers).

Data collected automatically during Platform use:

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser/app version;
• Session timestamps, login history, and session duration;
• Game play history, betting records, and transaction logs;
• Pages visited, features used, and click-path behaviour within the Platform;
• Cookie identifiers and similar tracking data (see the Cookies section below).

Data received from third parties:

• Identity verification results from KYC service providers;
• Payment confirmation and status data from bKash, Nagad, Rocket, Upay, and banking partners;
• Fraud screening signals from security and anti-money-laundering service providers.

3. How We Use Your Data

kui99 processes your personal data only for the purposes set out in this section. Each processing activity is grounded in one of the following legal bases: performance of a contract with you, compliance with a legal obligation, our legitimate interests as a gaming operator, or your explicit consent where required.

kui99 does not use your personal data to make fully automated decisions that produce legal or similarly significant effects without human oversight. Where automated systems flag an account for review (for example, in fraud or responsible gaming monitoring), a human member of the kui99 compliance team reviews the case before any account-level action is taken.

If you have opted in to receive promotional communications from kui99, you may withdraw your consent at any time by contacting [email protected] or by using the unsubscribe link included in every marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. Cookies & Tracking Technologies

kui99 uses cookies and similar technologies (including local storage and session identifiers) to operate the Platform securely, remember your preferences, and understand how players interact with different parts of the site. The following categories of cookies are used on the kui99 Platform:

• Strictly Necessary Cookies: These are essential for the Platform to function. They enable core features such as secure login, session management, and anti-fraud protection. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: These remember your preferences — such as your preferred language, display settings, and last-used payment method — so that your experience is consistent across sessions.
• Performance & Analytics Cookies: These collect anonymised data about how players navigate the Platform. This information helps us identify popular features, resolve technical issues, and improve overall usability. No personally identifiable information is stored in analytics cookies.
• Security Cookies: These assist in detecting and preventing fraudulent activity, protecting your account from unauthorised access, and enforcing session timeouts after periods of inactivity.

kui99 does not deploy third-party advertising cookies, behavioural retargeting cookies, or cross-site tracking pixels on the Platform. Your browsing activity on kui99 is not shared with advertising networks.

Cookies set by kui99 are first-party cookies served from the kui99.com domain. Session cookies are deleted automatically when you close your browser. Persistent cookies are stored for a maximum of 12 months, after which they expire and are cleared.

5. Data Sharing & Third Parties

kui99 does not sell, rent, or disclose your personal data to third parties for their own marketing or commercial purposes. We share your personal data only in the limited circumstances described below, and only with parties who are contractually bound to protect it.

Categories of third parties with whom data may be shared:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment processors require transaction data to facilitate deposits and withdrawals. These providers are subject to their own privacy policies and data protection obligations.
• KYC and Identity Verification Providers: Third-party services assist kui99 in verifying the identity and age of players during the KYC process. These providers receive the minimum data necessary to complete verification and are prohibited from using it for other purposes.
• Fraud Prevention and Security Services: Specialised security providers receive device fingerprint data, IP addresses, and transaction signals to identify patterns consistent with fraud, money laundering, or account compromise.
• Game Content Providers: Casino game studios such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data to support game functionality. These providers do not receive personally identifiable information beyond what is technically required for game delivery.
• Cloud Infrastructure Providers: kui99 uses secure cloud hosting services to store Platform data. These providers operate under strict data processing agreements and do not have permission to access or process your data for their own purposes.
• Law Enforcement and Regulatory Authorities: kui99 may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or where we believe disclosure is necessary to prevent or detect a crime.

All third-party data processors engaged by kui99 are required to implement appropriate technical and organisational security measures, to process data only on documented instructions from kui99, and to delete or return data upon the termination of their engagement.

6. Data Retention Periods

kui99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted from kui99 systems or irreversibly anonymised so that it can no longer be associated with any individual. Where data is subject to multiple retention obligations (for example, transaction data that is also relevant to a dispute), the longer retention period applies.

7. Your Privacy Rights

kui99 recognises and respects your rights in relation to your personal data. The following rights are available to all registered players and, where applicable, to unregistered visitors of the kui99 Platform:

• Right of Access: You have the right to request a copy of the personal data that kui99 holds about you. We will provide this information in a clear, structured format within 10 business days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details directly through your account settings page.
• Right to Erasure: Subject to our legal retention obligations, you may request the deletion of your personal data. Note that data subject to regulatory retention requirements (such as KYC and transaction records) cannot be deleted before the mandated retention period has elapsed.
• Right to Restriction of Processing: You may request that kui99 restricts the processing of your data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: You may request that kui99 provide your personal data in a machine-readable format so that it can be transferred to another service provider where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests. You also have an absolute right to object to the use of your data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact the kui99 privacy team at [email protected] with the subject line "Privacy Rights Request". We may need to verify your identity before processing your request. All requests will receive an initial response within 5 business days.

8. Data Security Measures

kui99 implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data from unauthorised access, accidental loss, destruction, or disclosure.

Technical controls in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the kui99 Platform;
• AES-256 encryption at rest for all databases containing personal data;
• Bcrypt hashing for stored passwords — plaintext passwords are never stored;
• Firewall protection and intrusion detection systems at the network perimeter;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for all internal administrative access to production systems;
• Regular automated vulnerability scanning and periodic manual penetration testing;
• Automated session timeout after 30 minutes of player inactivity.

Organisational controls include:

• Privacy and data security training for all kui99 staff who handle personal data;
• Binding confidentiality obligations for all employees and contractors;
• Data processing agreements with all third-party processors;
• A documented incident response plan for data breaches, including notification procedures.

In the event of a data security incident that is likely to result in a risk to the rights and freedoms of affected players, kui99 will notify impacted individuals promptly and take immediate steps to contain the incident, assess its scope, and restore the security of affected systems.

While kui99 applies every reasonable technical and organisational measure to protect your data, no online platform can guarantee absolute security against all possible threats. You also have a role to play in protecting your account: use a strong, unique password for your kui99 account, do not share your login credentials with anyone, and contact [email protected] immediately if you suspect unauthorised access to your account.

9. Changes to This Policy

kui99 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When material changes are made, we will update the "Last Updated" date shown at the top of this document.

Where changes are significant — for example, where we introduce a new purpose for processing personal data that is materially different from those disclosed in the current policy — we will notify registered players by email to the address associated with their kui99 account prior to the changes taking effect. The notification will describe the nature of the change and the date it will take effect, and will provide a link to the updated policy.

Your continued use of the kui99 Platform following the effective date of any update to this policy constitutes your acknowledgment of the updated terms. If you do not agree with the updated policy, you should stop using the Platform and may request account closure by contacting [email protected].

Previous versions of this Privacy Policy are available upon written request to [email protected].

10. Contact the Privacy Team

kui99 is committed to handling all privacy-related enquiries promptly, transparently, and with respect for your rights. If you have any questions about this Privacy Policy, wish to exercise a data subject right, have a complaint about how your data has been handled, or simply want to understand more about how kui99 protects your information, please get in touch using the details below.

• Email: [email protected] (subject line: "Privacy Enquiry" or "Privacy Rights Request")
• Response Time: Initial response within 5 business days; full resolution within 10 business days for straightforward requests
• Operating Hours: 7 days a week, Bangladesh Standard Time (UTC+6)
• Language: All privacy correspondence is handled in English

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter through an independent dispute resolution process. We will provide guidance on the appropriate escalation path upon request.