kaj9 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy ("Policy") describes the practices of kaj9 ("the Company", "we", "us", "our") with respect to the collection, use, storage, sharing, and protection of personal data belonging to registered players, visitors, and prospective users ("you", "your") of the kaj9 online betting and casino platform, accessible at https://kaj9.io and its associated mobile-optimised interfaces (collectively, "the Platform").

kaj9 is committed to handling personal data with transparency, integrity, and in full compliance with applicable data protection principles. This Policy is intended to give you a clear and complete understanding of exactly how your information is treated from the moment you first visit the Platform through to the closure of your account and beyond.

This Policy should be read in conjunction with the kaj9 Terms & Conditions and Responsible Gaming Policy, both of which are available on this website. Where any conflict arises between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail unless this Policy expressly states otherwise with respect to a specific data protection matter.

kaj9 collects personal data through several channels in the ordinary course of operating the Platform. The categories of data we collect, and the circumstances in which we collect them, are described below.

2.1 Registration and Account Data

When you create a kaj9 account, we collect the following information: your full legal name, date of birth, residential address (including city — for example, Dhaka, Chittagong, Sylhet, Khulna, or Rangpur), email address, mobile phone number, and a username and password of your choosing.

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering requirements and to confirm your age eligibility (21+), we collect copies of identity documents you submit during the verification process. These may include a national identity card, passport, or driving licence, as well as proof of address documents such as a utility bill or bank statement issued within the preceding three months.

2.3 Financial and Transaction Data

We collect records of all financial transactions conducted through your kaj9 account, including deposit amounts, withdrawal requests, payment method identifiers (such as your bKash or Nagad account number), and transaction timestamps. We do not store full card numbers; card transactions are processed through PCI-DSS compliant payment processors.

2.4 Betting and Gaming Activity Data

We maintain detailed records of your betting and gaming activity on the Platform, including markets wagered on, bet amounts, outcomes, bonus usage, game session durations, and responsible gaming interactions such as deposit limit changes or cooling-off requests.

2.5 Device and Technical Data

When you access the Platform, our servers automatically collect technical data about your device and connection, including your IP address, browser type and version, operating system, device identifiers, screen resolution, and time-zone settings. This data is used to optimise Platform performance and to detect fraudulent or suspicious access patterns.

2.6 Communications Data

If you contact our customer support team, we retain records of your communications including chat transcripts, email correspondence, and support ticket content. This data is used to resolve your query, train our support staff, and improve service quality.

The personal data collected by kaj9 is used exclusively for the following purposes:

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review. Where profiling is used — for example, to identify potential problem gambling behaviour — a member of our responsible gaming team will always conduct a human assessment before any material action is taken on your account.

kaj9 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and kaj9 — that is, to operate your account, process transactions, and deliver the betting and gaming services you have signed up for.
• Legal obligation: Processing is required to comply with applicable anti-money laundering laws, age verification requirements, and any other legal obligations to which kaj9 is subject.
• Legitimate interests: Processing is in kaj9's legitimate interest where it does not override your fundamental rights and freedoms. This includes fraud prevention, Platform security, and aggregate analytics used to improve the service.
• Consent: Where processing is based on your consent — for example, for the receipt of promotional emails or push notifications — you may withdraw that consent at any time by contacting our support team or updating your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

kaj9 does not sell or rent personal data to any third party. We share personal data only with the following categories of recipient, and only to the extent strictly necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard network processors receive transaction data necessary to process your deposit and withdrawal requests. These providers are bound by their own privacy and security obligations under applicable financial regulations.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe receive a session token and anonymised player identifier to deliver game content. We do not share your full name or contact details with game providers.
• Identity verification and KYC partners: Third-party KYC technology providers may process your identity documents on our behalf for verification purposes. These providers operate under strict data processing agreements and may not use your data for any other purpose.
• Fraud detection services: We may share technical data (IP addresses, device fingerprints) with anti-fraud platforms to identify and prevent fraudulent or abusive activity on the Platform.
• Law enforcement and regulatory bodies: We may disclose personal data to government agencies, law enforcement authorities, or courts where we are legally compelled to do so or where disclosure is necessary to protect the rights, property, or safety of kaj9 or its users.
• Professional advisors: Legal counsel, auditors, and other professional advisors engaged by kaj9 may access personal data on a strictly confidential, need-to-know basis.

All third parties with whom kaj9 shares personal data are required to implement appropriate technical and organisational measures to protect that data and are prohibited from using it for any purpose other than the one for which it was shared.

kaj9 uses cookies and similar client-side tracking technologies to operate and improve the Platform. A "cookie" is a small text file stored on your device when you visit a website. The following categories of cookie are used on the kaj9 Platform:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account state between pages, and enable security features. The Platform cannot function correctly without these cookies, and they cannot be disabled.
• Functional cookies: These cookies remember your preferences such as language settings, display options, and betting market selections, allowing the Platform to provide a personalised experience between visits.
• Analytics cookies: We use anonymised analytics tools to understand aggregate patterns of Platform usage — for example, which game categories are most popular and which pages generate the most support queries. This data is used exclusively to improve the Platform and is never linked to an identified individual.
• Security cookies: Short-lived cookies used to detect and prevent cross-site request forgery (CSRF), session hijacking, and other common web security threats.

kaj9 does not use advertising cookies, retargeting cookies, or any tracking mechanism designed to build a profile of your browsing activity across third-party websites. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may impair your ability to use the Platform.

kaj9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Personal, financial, and gaming data associated with an active account is retained for the duration of the account relationship and for a minimum of five years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC verification documents: Identity documents are retained for a minimum of five years from the date of verification or from account closure, whichever is later.
• Transaction records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five years following the date of the transaction.
• Customer support communications: Support correspondence is retained for a period of three years from the date of the last interaction.
• Marketing consent records: Records of your marketing consent or opt-out decisions are retained for the life of your account plus three years, to demonstrate compliance with consent requirements.
• Anonymised analytics data: Aggregated, non-identifiable usage data may be retained indefinitely for Platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data cannot be immediately deleted due to technical constraints, it is isolated from active processing until deletion is possible.

As a player on the kaj9 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team using the details provided in Section 12 of this Policy:

• Right of access: You may request a copy of all personal data we hold about you. We will provide this information in a clear, portable format within a reasonable timeframe.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many account details directly through your profile settings.
• Right to erasure: Subject to our legal retention obligations, you may request that we delete your personal data. This right applies where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis applies.
• Right to restriction of processing: You may request that we temporarily restrict the processing of your data while a dispute regarding its accuracy or the lawfulness of its use is being resolved.
• Right to data portability: Where processing is based on your consent or on contract performance, you may request that we provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to object: You may object to processing carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

kaj9 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security: All data transmitted between your device and the kaj9 Platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates. The padlock icon in your browser confirms that your connection is secure.
• Password hashing: Account passwords are never stored in plain text. They are processed using a modern, computationally intensive one-way hashing algorithm so that even in the unlikely event of a database compromise, passwords cannot be recovered.
• Access controls: Access to personal data within kaj9's systems is restricted on a strict need-to-know basis. Staff who require access to customer data for legitimate operational reasons are subject to background checks and data protection training.
• Fraud monitoring: Automated systems continuously monitor account activity for patterns indicative of fraudulent access, credential stuffing, or account takeover attempts. Suspicious activity triggers additional verification requirements and, where necessary, temporary account holds.
• Secure data centres: Personal data is stored on servers located in secure data centre facilities operating to recognised international security standards. Physical access to these facilities is restricted to authorised personnel only.
• Incident response: In the event of a personal data breach that poses a risk to your rights and freedoms, kaj9 will take immediate containment action and notify affected individuals without undue delay. We maintain a documented incident response procedure for this purpose.

While kaj9 employs robust security measures, no system connected to the internet can be guaranteed to be completely impenetrable. You play an important role in keeping your account secure by using a strong, unique password, enabling any available two-factor authentication, and logging out of your account on shared devices.

The kaj9 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data belonging to any person under the age of 21. Our registration process includes mandatory age verification, and we conduct additional KYC checks to confirm that no underage individual gains access to real-money betting or gaming features.

If kaj9 becomes aware that personal data has been collected from a person under 21, we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by law, and refund any deposits made by the underage individual to the original payment source.

If you are a parent or guardian and you believe that a minor in your care has created a kaj9 account or otherwise provided personal data to the Platform, please contact our support team immediately at [email protected] (plain text — not a clickable link). We take underage access extremely seriously and will act on any such report without delay.

kaj9 reserves the right to update or modify this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will notify you by email to the address registered on your account and by displaying a prominent notice on the Platform, at least 14 days before the changes take effect.

For minor, non-material changes (such as clarifications of existing language, corrections of typographical errors, or updates to contact information), we will update the "Last Updated" date at the top of this Policy and the change will take effect immediately upon posting.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you should close your account before the change takes effect. Any personal data collected prior to the effective date will continue to be processed under the version of the Policy in force at the time of collection, unless you consent to the new terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way kaj9 handles your personal data, please contact our support team. All privacy-related enquiries are handled confidentially and with priority by our dedicated data protection team.

Contact details for privacy matters:

• Email: [email protected] (plain text — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Language: English
• Response time: We aim to acknowledge all privacy requests within 48 hours and to resolve substantive requests within 30 days of receipt.

Please include your registered username, the email address associated with your account, and a clear description of your request in any privacy-related communication. This information allows us to locate your data promptly and respond accurately.