Privacy Policy — How kcu9 Protects Your Data

1. Introduction

kcu9 ("kcu9", "we", "us", "our") operates the online betting and casino platform accessible at kcu9.io ("Platform"). We are committed to protecting the privacy and personal data of all individuals who interact with our Platform, including registered members, prospective members, and visitors.

This Privacy Policy ("Policy") describes in detail what personal information kcu9 collects, the purposes for which it is processed, how it is stored and protected, with whom it may be shared, and what rights you hold in relation to your personal data. This Policy applies to all services offered through the kcu9 Platform, including sports betting, live casino, slots, account management, and customer support.

By registering an account or continuing to use the kcu9 Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, you should not access or use the Platform. This Policy should be read alongside our Terms & Conditions, which govern your overall use of kcu9 services.

2. Personal Data We Collect

kcu9 collects personal data through a number of channels. The categories of personal data we may collect include, but are not limited to, the following:

2.1 Registration Data

• Full legal name
• Date of birth (used to verify 21+ age eligibility)
• Residential address in Bangladesh (city, district, postal code)
• Email address
• Mobile phone number
• Username and encrypted password

2.2 Identity Verification (KYC) Data

• National ID Card number and scanned copy, or passport details
• Proof of address document (utility bill, bank statement)
• Selfie or live facial verification image (where required for enhanced KYC)
• Tax identification number (where required by applicable compliance obligations)

2.3 Financial Data

• Mobile financial service account details used for deposits and withdrawals (bKash, Nagad, Rocket, Upay)
• Bank account details (for members using bank transfer payment methods including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank)
• Card type, last four digits, and billing name (for Visa and Mastercard transactions)
• Transaction history, including deposits, withdrawals, bonuses credited, and wager records

2.4 Platform Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Pages visited, session duration, and navigation patterns
• Betting and gaming activity, including markets accessed, wagers placed, game sessions, and outcomes
• Login timestamps and session identifiers

2.5 Communications Data

• Content of messages sent to kcu9 via live chat, email, or support ticket
• Survey responses and feedback submissions
• Promotional preference settings and opt-in or opt-out records

3. How We Collect Your Data

kcu9 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey.
• Automatically — through cookies, server logs, and analytics tools as you navigate and interact with the Platform.
• From third-party service providers — including KYC verification partners, payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard), fraud detection services, and game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi).
• From publicly available sources — such as sanctions screening databases and fraud watchlists, which kcu9 consults as part of its Anti-Money Laundering (AML) compliance programme.

4. Purposes of Processing Your Personal Data

kcu9 processes personal data only for specific, legitimate purposes. The table below summarises the primary purposes for which your data is used:

5. Legal Basis for Processing

kcu9 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and kcu9, including account registration, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, KYC requirements, and tax reporting duties.
• Legitimate interests: Processing carried out in the pursuit of kcu9's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — such as the sending of promotional and marketing communications. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

kcu9 does not sell or commercially exploit your personal data. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection agreements:

6.1 Payment Processors

Financial data is shared with payment partners — including bKash, Nagad, Rocket, Upay, Visa, and Mastercard — only to the extent necessary to process your deposit or withdrawal transaction. Each payment partner operates under its own privacy policy and is independently responsible for its data handling practices.

6.2 KYC and Compliance Partners

Identity documents and verification data may be shared with accredited third-party KYC service providers to authenticate your identity and screen against sanctions and fraud watchlists. These partners are contractually prohibited from using your data for any purpose beyond the specific verification task.

6.3 Game Providers

A limited set of account data (such as a player identifier and session token) may be shared with third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — to enable you to play their games through the kcu9 Platform. No financial or identity document data is shared with game providers.

6.4 Legal and Regulatory Disclosure

kcu9 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required by law, court order, or where kcu9 has a good-faith belief that disclosure is necessary to prevent fraud, protect the safety of persons, or enforce our Terms & Conditions.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of kcu9's business, personal data held by kcu9 may be transferred to the acquiring entity, subject to equivalent data protection obligations being maintained.

7. Data Retention

kcu9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and compliance obligations. The following general retention periods apply:

• Account and registration data: Retained for the duration of your membership and for a minimum of 5 years following account closure, in accordance with AML record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of verification, or longer if required by a specific legal obligation.
• Transaction records: Retained for a minimum of 5 years following the date of each transaction.
• Customer support communications: Retained for 2 years from the date of the last interaction, unless the communication relates to an unresolved dispute or legal matter.
• Marketing consent records: Retained for 3 years from the date consent was last confirmed or until consent is withdrawn, whichever is earlier.
• Anonymised analytics data: May be retained indefinitely, as it cannot be linked back to an identifiable individual.

8. Data Security

kcu9 implements a layered approach to data security, combining technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the kcu9 Platform.
• AES-256 encryption for sensitive data stored at rest on kcu9 servers.
• Role-based access controls ensuring that only authorised personnel with a legitimate business need may access personal data.
• Multi-factor authentication requirements for internal systems handling member data.
• Regular security assessments and vulnerability scanning of the kcu9 Platform infrastructure.
• Staff training on data protection obligations and information security best practices.

Despite these measures, no method of transmission over the internet is completely secure. In the event of a data breach that poses a material risk to affected members, kcu9 will notify impacted individuals promptly and take immediate remediation steps.

9. Cookies and Tracking Technologies

The kcu9 Platform uses cookies — small text files placed on your device — to support essential platform functionality and to improve your experience. The categories of cookies used by kcu9 are as follows:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session cookies that maintain your login state and security tokens. These cookies cannot be disabled without affecting Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how members navigate and interact with the Platform, enabling kcu9 to identify performance issues and optimise the user experience. These cookies do not identify you personally.
• Preference Cookies: Used to remember your Platform settings and preferences, such as language selection and notification preferences.

kcu9 does not use third-party advertising cookies or tracking pixels that would share your browsing behaviour with external advertising networks or social media platforms. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may impair your ability to use certain features of the kcu9 Platform.

10. Your Data Rights

Subject to applicable law, you hold the following rights in relation to personal data that kcu9 holds about you:

• Right of Access: You may request a copy of the personal data kcu9 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data is corrected or updated. Minor corrections (such as email address updates) can be made directly from Account Settings.
• Right to Erasure: In certain circumstances, you may request that kcu9 deletes your personal data. This right is subject to overriding legal retention obligations (see Section 7).
• Right to Restriction: You may request that kcu9 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contract, you may request a machine-readable copy of your personal data for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, kcu9 will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected]. kcu9 will acknowledge your request within 5 business days and endeavour to fulfil it within 30 days. We may ask you to verify your identity before processing certain requests.

11. Minors and Age Restriction

The kcu9 Platform is strictly for individuals aged 21 and above. kcu9 does not knowingly collect personal data from persons under the age of 21. If kcu9 discovers or is informed that a registered account belongs to a person under 21 years of age, that account will be immediately suspended, the data reviewed in accordance with our responsible gaming obligations, and appropriate steps taken in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a person under 21 in your care may have registered with kcu9, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

12. International Data Transfers

kcu9 primarily processes and stores personal data on servers located within or serving the Asia-Pacific region. In certain circumstances — for example, where a game provider or KYC partner operates infrastructure in another region — personal data may be transferred outside Bangladesh. Where such transfers occur, kcu9 ensures that appropriate safeguards are in place, including contractual data protection clauses that impose obligations equivalent to those set out in this Policy.

13. Changes to This Privacy Policy

kcu9 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform services. The date of the most recent revision is always displayed at the top of this document. Where changes are material — meaning they significantly affect how your data is processed or your rights in relation to it — kcu9 will notify you by email to the address registered on your Account and/or by a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the kcu9 Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the revised Policy, you should discontinue use of the Platform and contact [email protected] to close your account.

14. Contact Us — Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or kcu9's handling of your personal data, please contact our dedicated privacy team through one of the following channels:

• Privacy Enquiries: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 directly from the kcu9 Platform
• Response Time: Privacy enquiries are acknowledged within 5 business days and resolved within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

This Privacy Policy was last updated on 1 January 2026. This document supersedes all previous versions of the kcu9 Privacy Policy. All enquiries relating to data protection should be directed to [email protected].