kd66 Privacy Policy — How We Handle Your Personal Data

kd66 is Bangladesh's trusted online casino and sports betting platform, accessible at https://kd66.io (the "Platform"). We take the privacy of every player seriously, and this Privacy Policy ("Policy") has been written to give you a clear, honest account of how we handle the personal information you share with us when you use our services.

This Policy applies to all personal data collected through the kd66 Platform, including data collected via the website, any mobile-optimised version of the site, customer support interactions conducted via email or live chat, and any promotional activities we conduct in connection with the kd66 brand. It applies to all registered players, prospective players who browse the Platform without registering, and any individual who contacts kd66 for support or information purposes.

This Policy should be read in conjunction with the kd66 Terms & Conditions and the kd66 Responsible Gaming Policy, both of which are published on the Platform and incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a matter relating specifically to data privacy, this Policy shall take precedence.

kd66 operates its Platform in the English language and provides services primarily to players located across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. All personal data processing described in this Policy is conducted in the English language and all financial data is denominated in Bangladeshi Taka (৳ BDT).

kd66 collects personal data through several channels: directly from you when you register, deposit funds, or contact support; automatically through your use of the Platform; and, in limited cases, from trusted third-party verification services. The categories of personal data we collect are described below.

When you create a kd66 account, we collect: your full legal name, date of birth, email address, mobile phone number (used for account verification and SMS alerts), and your chosen username. This data is mandatory — without it, we cannot create or maintain your account.

To comply with our anti-money-laundering obligations and to confirm that all players are 21 years of age or older, kd66 may request copies of the following documents: Bangladesh National ID Card (NID), passport, or other government-issued photo identification; a utility bill, bank statement, or other proof of address dated within the last three months; and, where required, a selfie photograph taken by you for facial verification purposes. Verification documents are stored securely and accessed only by authorised compliance personnel.

When you make a deposit or request a withdrawal, kd66 collects transaction records including the payment method used (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard), the transaction amount in BDT, the transaction reference number provided by your payment provider, and the date and time of the transaction. kd66 does not store full card numbers or mobile banking PINs — these are processed directly by the respective payment providers using their own secure infrastructure.

kd66 automatically collects data about how you interact with the Platform, including: pages visited, games played (including game type, stake amounts, and session duration), bets placed and their outcomes, login timestamps, and navigation paths through the Platform. This data is used for service improvement, personalisation, and responsible gaming monitoring.

When you access the Platform, we collect technical information including your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and referring URL. This data helps us optimise the Platform's performance and detect fraudulent or unauthorised access attempts.

If you contact kd66 customer support, we retain records of those communications including email correspondence, live chat transcripts, and any attachments you provide. These records are used to resolve your query, improve our support service, and maintain an audit trail of formal complaints.

kd66 uses the personal data we collect exclusively for the purposes described in this Policy. We do not use your data for any purpose that is incompatible with these stated purposes without first obtaining your explicit consent. The primary purposes for which we process personal data are set out below.

• Account creation and management: To register your account, authenticate your identity at login, maintain your account settings and preferences, and communicate important account-related information to you.
• Payment processing: To process deposits and withdrawals in BDT through your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer), to reconcile transaction records, and to investigate and resolve payment disputes.
• Identity verification and fraud prevention: To confirm that you are at least 21 years of age, to verify that the payment methods you use are in your name, to detect duplicate accounts, and to identify and prevent fraudulent, collusive, or money-laundering activity on the Platform.
• Service delivery and improvement: To make the games, betting markets, and features of the Platform available to you, to personalise your experience based on your preferences and play history, and to improve Platform performance based on aggregated usage analytics.
• Customer support: To respond to your queries, process your complaints, and maintain records of our communications for quality and audit purposes.
• Responsible gaming: To monitor your gambling patterns for signs of problem gambling behaviour, to apply and enforce the deposit limits, session limits, and self-exclusion restrictions you set, and to proactively contact you if our systems detect indicators of potential harm.
• Legal compliance: To comply with applicable anti-money-laundering obligations, to respond to lawful requests from regulatory or law enforcement authorities, and to maintain financial records for the legally required retention period.
• Marketing communications (where opted in): To send you promotional offers, bonus announcements, and seasonal event information — such as Eid specials, Pohela Boishakh promotions, or BPL cricket betting features — where you have provided explicit consent to receive such communications. You may withdraw consent at any time.

Every instance of personal data processing by kd66 is grounded in one of the following legal bases:

• Contractual necessity: Processing that is required to perform the contract between you and kd66 — namely, the Terms & Conditions you accepted when registering. This covers account management, payment processing, and service delivery.
• Legal obligation: Processing that kd66 is required to carry out under applicable law, including anti-money-laundering checks, age verification, and the retention of financial transaction records.
• Legitimate interests: Processing carried out for purposes that are in the legitimate interests of kd66 or of other players, where those interests are not overridden by your privacy rights. This includes fraud detection, platform security, service analytics, and responsible gaming monitoring.
• Consent: Processing that is based on your freely given, specific, and informed consent. Marketing communications fall into this category. You may withdraw your consent at any time by contacting [email protected] or by adjusting your account communication preferences.

Where kd66 relies on legitimate interests as the legal basis for processing, we have conducted an assessment to confirm that the legitimate interest pursued does not override your fundamental rights and freedoms as a data subject. A summary of these assessments is available on request by contacting [email protected].

kd66 does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. Your data may be shared with the following categories of third party, strictly on a need-to-know basis and solely to enable the delivery of kd66 services to you:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive transaction-level data necessary to process your deposit or withdrawal. Each provider operates under its own privacy framework and security standards.
• Game technology providers: Licensed game studios including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe may receive a pseudonymous player identifier and session data necessary to deliver their games. These providers do not receive your full name, NID, or payment details.
• Identity verification services: Third-party KYC (Know Your Customer) and age verification providers may process copies of your identification documents to confirm your identity and age. These providers are contractually bound to process verification data exclusively for the purpose of performing verification on kd66's behalf.
• IT infrastructure providers: Cloud hosting, database management, and cybersecurity service providers that support the operation of the Platform may have access to personal data as part of their service delivery. All such providers are bound by data processing agreements that restrict their use of your data to the specific services they provide to kd66.
• Legal and regulatory authorities: kd66 may disclose personal data to law enforcement agencies, financial intelligence units, or other governmental authorities where required to do so by applicable law, by court order, or where kd66 reasonably believes that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

kd66 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used by kd66:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable you to log in to your account, maintain your session while you navigate between pages, and ensure that your account security settings are applied correctly. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance and analytics cookies: These cookies collect aggregated, anonymised information about how players use the Platform — for example, which pages are visited most frequently, how long sessions last, and which games are most popular. This data is used to improve Platform performance and content. No individually identifiable data is collected through analytics cookies.
• Functionality cookies: These cookies remember your preferences — such as your preferred language setting, display preferences, and recently viewed game categories — so that the Platform can provide a more personalised experience on your return visits.
• Fraud prevention cookies: These cookies help kd66 identify and prevent fraudulent account activity, including the detection of multiple accounts operating from the same device or IP address, and the flagging of unusual login patterns.

Most web browsers allow you to control cookie settings through the browser's preferences menu. You may disable non-essential cookies without preventing your access to the Platform, but some functionality — such as personalised game recommendations — may be reduced as a result. Please note that disabling strictly necessary cookies will prevent you from logging in to your kd66 account.

kd66 does not use third-party advertising cookies or behavioural tracking pixels that share your data with external advertising networks.

kd66 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our key security measures include the following:

• SSL/TLS encryption: All data transmitted between your device and kd66 servers is encrypted in transit using SSL/TLS protocols. The padlock icon in your browser's address bar confirms that your connection to kd66.io is encrypted.
• Data encryption at rest: Sensitive personal data — including identity documents and payment records — is encrypted when stored in kd66's database infrastructure using AES-256 encryption or equivalent standards.
• Access controls: Access to personal data within kd66's systems is restricted on a strict need-to-know basis. Only authorised personnel whose job functions require access to specific categories of data are granted that access, and all access events are logged and audited.
• Password security: Account passwords are stored as cryptographic hashes — never in plain text. kd66 strongly encourages players to use a unique, complex password and to change it regularly. Two-factor authentication options may be available within your account settings.
• Penetration testing and security audits: kd66 conducts regular security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, kd66 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

While kd66 takes all reasonable steps to protect your personal data, no system is entirely immune to security threats. Players are encouraged to take their own precautions — including using a strong, unique password for their kd66 account and never sharing their login credentials with anyone. If you believe your account has been compromised, contact [email protected] immediately.

kd66 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of personal data we hold:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Where anonymisation is used, the resulting aggregated data may be retained indefinitely for statistical and analytical purposes without constituting personal data processing.

If you request the deletion of your personal data before the end of the applicable retention period, kd66 will action your request to the extent possible while retaining only the data that must legally be kept, such as transaction records required for anti-money-laundering compliance. We will inform you of any data that cannot be deleted and the reason why.

As a player on the kd66 Platform, you have a number of rights in relation to the personal data we hold about you. These rights are set out below. To exercise any of these rights, please contact kd66 at [email protected] with the subject line "Data Rights Request". We will respond to all data rights requests within 10 business days of receipt.

• Right of Access: You have the right to request a copy of all personal data that kd66 holds about you. We will provide this in a structured, commonly used, and machine-readable format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You may be able to update certain account details directly through your account settings without contacting support.
• Right to Erasure: You have the right to request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw your consent and there is no other legal basis for processing. This right is subject to the retention obligations described in Section 8.
• Right to Restriction of Processing: In certain circumstances, you have the right to request that kd66 restricts the processing of your personal data — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, machine-readable format and to transfer it to another data controller of your choice.
• Right to Object: You have the right to object to the processing of your personal data where kd66 relies on legitimate interests as the legal basis for processing. You also have an unconditional right to object to the use of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

If you are not satisfied with kd66's response to a data rights request, or if you believe that kd66 is not processing your personal data in accordance with applicable privacy law, you have the right to raise a complaint through the dispute resolution process described in the kd66 Terms & Conditions.

The kd66 Platform is strictly intended for individuals who are 21 years of age or older. kd66 does not knowingly collect or process personal data belonging to persons under the age of 21. Age verification is conducted as part of the account registration and withdrawal process to enforce this requirement.

If kd66 discovers that it has inadvertently collected personal data from a person under the age of 21, that account will be immediately suspended, all associated funds will be reviewed in accordance with our Terms & Conditions, and the personal data of the minor will be securely deleted from our systems as promptly as possible.

If you are a parent or legal guardian and you believe that a minor in your care has registered on the kd66 Platform, please contact us immediately at [email protected] so that we can take prompt action. We take underage gambling extremely seriously and will act without delay on any credible report involving a minor.

kd66 may send you promotional communications — including bonus offers, seasonal promotions (such as Eid specials, BPL cricket betting features, and Pohela Boishakh campaigns), and platform news — by email or SMS. These communications will be sent only where you have explicitly opted in to receive them, either at the time of registration or through your account communication preferences at a later date.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email sent by kd66.
• Replying "STOP" to any SMS marketing message sent by kd66.
• Updating your communication preferences within your kd66 account settings.
• Contacting kd66 support at [email protected] with the subject line "Unsubscribe — Marketing".

Withdrawal of marketing consent will be processed within 5 business days. Please note that withdrawal of marketing consent does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — which are sent as a necessary part of operating your account and cannot be disabled.

kd66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our services. When material changes are made to this Policy, kd66 will provide advance notice to registered players via a notification displayed on the Platform and, where appropriate, by email to the address associated with your account.

The updated Policy will take effect from the date specified in the notice. Your continued use of the kd66 Platform after the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with a proposed change to this Policy, you have the right to close your account before the change takes effect by contacting [email protected].

The date of the most recent update to this Policy is always displayed at the top of this page. We recommend that you review this Policy periodically — particularly before making a deposit or updating your account details — to ensure that you are aware of how your data is being used.

When submitting a data rights request, please include your registered account username and the email address associated with your kd66 account in your message, along with a clear description of the right you wish to exercise and the specific data it relates to. This will help our team locate your records and process your request as efficiently as possible.

Please mark urgent privacy matters — such as suspected unauthorised access to your account or a concern that your data has been shared without your consent — with the subject line "URGENT — Privacy" to ensure your message is prioritised. All formal data rights requests and privacy complaints are logged, tracked, and responded to in writing.

Postal or in-person enquiries are not accepted. All privacy-related communications with kd66 must be submitted in English via email to [email protected] to ensure they are handled by the correct team and recorded accurately in our compliance systems.