ka99 Privacy Policy — How We Handle Your Data

1 Overview

This Privacy Policy ("Policy") sets out the practices of ka99 ("ka99", "we", "us", "our") regarding the collection, storage, use, transfer, and protection of personal data provided by or generated through users ("Player", "User", "you") of the ka99 online betting and casino platform, accessible at ka99.io and its associated subdomains and mobile interfaces.

ka99 is committed to handling personal data with transparency, integrity, and care. We recognise that players entrust us with sensitive information — including financial details and betting history — and we take that responsibility seriously. This Policy is designed to give you a clear and complete picture of exactly how that information is managed from the moment you first visit the ka99 platform to the point at which your account is closed and data is permanently deleted.

This Policy applies to all personal data processed by ka99 in connection with the services offered through the platform, regardless of whether those services are accessed via a desktop browser, a mobile browser, or any other interface through which ka99 is made available. It applies to all players based in Bangladesh and to any other users who interact with the platform from other locations.

2 Data Controller

For the purposes of this Privacy Policy, ka99 acts as the data controller in respect of the personal data of all registered players and website visitors. As data controller, ka99 is responsible for determining the purposes for which personal data is collected and the means by which it is processed.

All enquiries relating to the use of your personal data, including requests to exercise any of your rights under applicable data protection legislation, should be directed to the ka99 data protection contact at the following address:

3 Data We Collect

ka99 collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises the main categories of personal data we collect and provides examples of the specific data points within each category.

ka99 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information beyond what may be disclosed voluntarily in the context of a responsible gaming support request. Any such data disclosed in that context is handled with heightened care and used solely for the purpose of providing the responsible gaming assistance requested.

4 How Data Is Collected

Personal data is collected by ka99 through the following channels and mechanisms:

4.1 Direct Submission

The most significant portion of personal data held by ka99 is data that you provide to us directly. This occurs when you complete the registration form to open an account, when you upload identity verification documents as part of the KYC process, when you submit a deposit or withdrawal request through the Cashier section, when you contact customer support via live chat or email, or when you update your account profile settings.

4.2 Automated Technical Collection

When you visit or interact with the ka99 platform, certain technical data is collected automatically by our systems. This includes your IP address (used to determine approximate geographic location and for fraud prevention), device identifiers, browser fingerprint data, session timestamps, and behavioural data such as pages visited and features clicked. This data is collected through a combination of server logs, cookies, and similar tracking technologies. Please refer to Section 10 (Cookies & Tracking) for full details.

4.3 Third-Party Sources

In certain circumstances, ka99 may receive personal data about you from third parties. This may include identity verification agencies used to confirm the authenticity of KYC documents, payment processors and mobile money providers (bKash, Nagad, Rocket, Upay) who confirm transaction status and account ownership, anti-fraud and anti-money-laundering screening services, and publicly available sources such as sanctions lists and politically exposed persons (PEP) databases. Data received from third-party sources is used solely for the purposes described in this Policy.

5 Purpose of Processing

ka99 processes personal data only for specific, legitimate purposes. We do not use your data in ways that you would not reasonably expect, and we do not sell your personal data to third parties for their own marketing purposes. The purposes for which we process your personal data are as follows:

• Account Management: Creating, maintaining, and administering your player account, including processing login authentication, managing account settings, and handling account closure requests.
• Service Delivery: Enabling you to place bets, play casino games, access live dealer tables, and use all features of the ka99 platform as described in the Terms & Conditions.
• Payment Processing: Processing deposits and withdrawals in Bangladeshi Taka (৳) via bKash, Nagad, Rocket, Upay, and partner banks, including verifying that payment accounts are registered in your own name.
• Identity Verification (KYC): Verifying your age (21+ requirement), identity, and payment method ownership in accordance with our responsible gaming and anti-fraud policies.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, multi-account operations, bonus abuse, money laundering, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible Gaming: Monitoring betting patterns to identify potential problem gambling behaviour, applying player-requested responsible gaming tools (deposit limits, self-exclusion, session reminders), and facilitating access to support resources.
• Customer Support: Responding to enquiries, resolving disputes, processing complaints, and providing technical assistance via live chat and email.
• Legal and Regulatory Compliance: Fulfilling obligations under applicable laws, including record-keeping requirements, responding to lawful requests from regulatory or law enforcement authorities, and maintaining audit trails.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, user experience, and the reliability of payment processing.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may opt out at any time via your account settings or by contacting [email protected].

6 Legal Basis for Processing

ka99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual Necessity: The majority of personal data processing by ka99 is necessary to perform the contract between us and you — that is, to operate your account and deliver the betting and gaming services you have signed up for. Without this processing, we cannot provide the service.
• Legitimate Interests: ka99 processes certain data on the basis of its legitimate interests in operating a safe, fair, and commercially viable online gaming platform. This includes fraud prevention, security monitoring, product analytics, and internal record-keeping. We only rely on this basis where our interests are not overridden by your interests or fundamental rights.
• Legal Obligation: Some processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) checks, identity verification requirements, and responding to lawful authority requests.
• Consent: Where we rely on consent as the legal basis for processing — for example, in relation to direct marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7 Data Sharing & Third Parties

ka99 does not sell, rent, or trade your personal data to unrelated third parties for their own commercial purposes. However, in order to operate the platform effectively and comply with our legal obligations, we do share data with the following categories of recipients:

7.1 Payment Processors

When you make a deposit or request a withdrawal, your payment details are shared with the relevant payment service provider (bKash, Nagad, Rocket, Upay, or the relevant partner bank). This sharing is strictly limited to the data necessary to process the specific transaction and is governed by the privacy practices of each payment provider.

7.2 Identity Verification Providers

During the KYC process, identity documents you submit may be shared with third-party identity verification services engaged by ka99 for the purpose of confirming authenticity. These providers operate under strict confidentiality agreements and may not use your data for any purpose other than performing the verification service.

7.3 Game Content Providers

Live casino and slot game content is delivered by third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. These providers may receive session-level technical data necessary to render games correctly and maintain game integrity (for example, a session token and game outcome data). They do not receive your full identity or financial data.

7.4 Fraud Prevention and AML Services

ka99 uses third-party services to screen player activity against sanctions lists, politically exposed persons (PEP) databases, and known fraud patterns. Certain identity and account data may be submitted to these services as part of this screening process.

7.5 Legal and Regulatory Authorities

ka99 may disclose personal data to courts, regulators, law enforcement agencies, or other government bodies where required to do so by applicable law, by court order, or by a lawful demand from a competent authority. In such cases, we will disclose only the minimum data required to satisfy the legal obligation and will notify you where permitted to do so.

8 Data Retention

ka99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

When personal data is no longer required for its stated purpose and no longer subject to a legal retention obligation, it is securely deleted or anonymised. Anonymised data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

9 Security Measures

ka99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security measures include:

• SSL/TLS Encryption: All data transmitted between your device and the ka99 platform is protected by 256-bit SSL/TLS encryption, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Password Hashing: Account passwords are never stored in plain text. They are processed using a strong one-way cryptographic hashing algorithm so that even internal ka99 staff cannot read your password.
• Access Controls: Access to personal data within ka99's internal systems is granted on a strict need-to-know basis. Staff with access to player data are subject to background checks, confidentiality agreements, and regular data security training.
• Two-Factor Authentication: ka99 supports and encourages the use of two-factor authentication (2FA) on player accounts to provide an additional layer of protection against unauthorised access.
• Fraud Detection Systems: Automated and manual fraud monitoring systems continuously analyse account activity for patterns consistent with account takeover, identity theft, or financial fraud, triggering alerts and protective interventions where warranted.
• Data Minimisation: ka99 collects only the personal data that is genuinely necessary for the purposes described in this Policy. We regularly review our data collection practices to ensure that unnecessary data is not retained.
• Incident Response: ka99 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, affected players will be notified promptly with details of what occurred and the steps taken to address it.

10 Cookies & Tracking Technologies

The ka99 platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience. A cookie is a small text file that is placed on your device when you visit a website. ka99 uses the following categories of cookies:

10.1 Strictly Necessary Cookies

These cookies are essential for the operation of the ka99 platform and cannot be disabled. They enable core functions such as maintaining your login session, remembering items in your bet slip, processing payments, and applying your responsible gaming settings. Without these cookies, the platform cannot function correctly.

10.2 Analytics Cookies

These cookies collect aggregated, anonymised information about how players use the ka99 platform, such as which pages are visited most frequently, how long players spend on different sections, and which features generate the most engagement. This data is used to improve the platform experience and is not linked to any individual player's identity.

10.3 Functional Cookies

Functional cookies allow ka99 to remember your preferences and settings, such as your preferred language (English), odds display format, and any interface customisations you have applied. They enhance the usability of the platform by eliminating the need to re-configure settings on each visit.

10.4 Security Cookies

Security cookies are used to detect fraudulent activity, prevent cross-site request forgery (CSRF) attacks, and maintain the integrity of login sessions. They do not collect any personally identifiable information beyond what is necessary for their security function.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair or entirely prevent the functioning of the ka99 platform. Disabling analytics or functional cookies will not affect your ability to use the platform but may result in a less personalised experience.

11 Payment Data & Financial Privacy

Given the nature of the ka99 platform, financial data is among the most sensitive categories of information we process. ka99 handles all payment data with particular care:

• All financial transactions — deposits and withdrawals in Bangladeshi Taka (৳) via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Islami Bank — are transmitted exclusively over encrypted connections.
• ka99 does not store full mobile money account PINs, full bank account passwords, or full card numbers (where applicable). Payment credentials used for authentication with mobile money providers are tokenised and stored in encrypted form.
• Transaction records (amounts, timestamps, payment method types, and partial account references) are retained for 7 years for financial record-keeping and AML compliance purposes.
• Payment data is shared only with the relevant payment provider processing a specific transaction and is not shared with any other third party without your explicit consent or a legal obligation to do so.
• ka99 employs automated AML (anti-money laundering) screening on all transactions. Large or unusual transactions may trigger a manual review by the compliance team, which may result in a request for additional documentation before the transaction is completed.

12 Your Data Rights

As a player whose personal data is processed by ka99, you hold the following rights in respect of that data. To exercise any of these rights, please contact [email protected] with the subject line "Privacy Request" and your registered account username. We will respond within 5 business days.

• Right of Access: You have the right to request a copy of the personal data that ka99 holds about you, along with information about how it is being used, where it came from, and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (such as updating your contact number), you may be able to make changes directly in your account settings.
• Right to Erasure: In certain circumstances, you have the right to request that ka99 delete your personal data. This right applies where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Please note that this right may be limited where ka99 is required to retain data to comply with a legal obligation (such as the 7-year financial record retention requirement).
• Right to Restriction: You may request that ka99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where processing is unlawful but you prefer restriction over erasure.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on ka99's legitimate interests, including profiling carried out for direct marketing purposes. Where you object to direct marketing, ka99 will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing. Opt-out controls are available directly in your account settings or by emailing [email protected].

13 Minors and Age Verification

The ka99 platform is strictly intended for individuals aged 21 years or older. ka99 does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and any account found to have been opened by a person under 21 will be immediately closed, all associated balances forfeited in accordance with the Terms & Conditions, and the personal data of the underage individual deleted from our systems as promptly as is consistent with our legal obligations.

If you believe that a minor has registered on the ka99 platform, please notify us immediately at [email protected]. We treat all such reports as urgent and will investigate and act on them promptly.

14 Changes to This Policy

ka99 reserves the right to amend this Privacy Policy at any time. Any changes will be published on this page with an updated "Last updated" date at the top of the document. Where changes are material — meaning they significantly affect your rights or the way in which your personal data is used — ka99 will notify registered players by email to the address associated with their account at least 14 days before the changes take effect.

Minor, non-material updates (such as clarifications to existing practices, corrections of typographical errors, or restructuring of content without substantive change) may be published without advance notice. Your continued use of the ka99 platform after the effective date of any updated version of this Policy constitutes your acknowledgment of the updated terms. If you do not accept the revised Policy, you should discontinue use of the platform and may request account closure by contacting [email protected].

We recommend that you review this Privacy Policy periodically to stay informed about how ka99 is protecting and using your personal data. Archived versions of previous policies are available on request from [email protected].

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which ka99 processes your personal data, please contact our support team using the details below. All privacy-related correspondence is handled by our data protection team and will receive a response within 5 business days (Bangladesh Standard Time, UTC+6).

For the fastest response, please include your registered username, a clear description of your request or concern, and — for data subject rights requests — a copy of a valid identity document so that we can verify your identity before processing the request.