kg22 Privacy Policy
Your Data, Handled With Care

Introduction & Scope

This Privacy Policy ("Policy") describes how kg22 ("kg22", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the kg22 online gaming platform at kg22.bio and all associated subdomains, mobile interfaces, and communication channels.

This Policy applies to all personal data collected in connection with your use of kg22's services, including account registration, identity verification, deposits and withdrawals, gameplay activity, customer support interactions, and marketing communications. It applies regardless of the device or method you use to access the platform.

By registering an account or otherwise using the kg22 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the kg22 Terms & Conditions and should be read in conjunction with that document. If you do not agree with any part of this Policy, you should discontinue use of the platform immediately.

Data Controller

kg22 acts as the data controller with respect to all personal data collected through the kg22 platform. As data controller, kg22 determines the purposes for which personal data is collected and the means by which it is processed. All data processing activities carried out by kg22 are conducted in accordance with applicable data protection principles and best-practice security standards.

For all privacy-related inquiries, data access requests, or complaints, the designated point of contact is the kg22 Privacy & Compliance team. Contact details are provided in Section 15 of this Policy.

Information We Collect

kg22 collects the following categories of personal data:

We do not intentionally collect special category data (e.g., health data, religious beliefs, political opinions) unless explicitly required by law or voluntarily provided by you in the context of a responsible gaming self-exclusion request, in which case such data is treated with the highest level of protection and used solely for the stated purpose.

How We Collect Your Data

kg22 collects personal data through the following channels:

• Direct interactions: Data you provide when completing the registration form, uploading KYC documents, contacting support, or participating in promotions;
• Automated technologies: Technical and usage data collected automatically as you navigate the platform, including via cookies, session tracking scripts, and server logs (see Section 10);
• Payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you make a deposit or withdrawal;
• Identity verification partners: Confirmation and risk-score data received from third-party KYC providers when we verify your submitted identity documents;
• Fraud detection systems: Device fingerprint and behavioural analytics data generated by our internal security infrastructure during platform sessions.

How We Use Your Data

kg22 uses your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your kg22 account and verifying your identity;
• Payment processing: Facilitating deposits, withdrawals, and the accurate crediting and debiting of your account balance;
• Legal compliance: Meeting obligations under applicable anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and any other applicable laws;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, prohibited conduct, and unauthorised account access;
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and enabling the delivery of responsible gaming tools such as deposit limits and self-exclusion;
• Platform improvement: Analysing aggregated usage data to improve game performance, user interface design, and overall platform reliability;
• Customer support: Responding to queries, resolving disputes, and maintaining records of support interactions;
• Marketing communications: Sending promotional emails and SMS messages where you have opted in to receive them. You may withdraw consent at any time by contacting support.

kg22 does not use automated decision-making or profiling in a way that produces legal or similarly significant effects on players, except where required by law or with your explicit prior consent.

Legal Basis for Processing

kg22 processes personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you accepted at registration (e.g., operating your account, processing payments);
• Legal obligation: Processing required to comply with AML laws, KYC regulations, tax reporting requirements, or other mandatory legal obligations;
• Legitimate interests: Processing necessary for our legitimate interests in fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights;
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — particularly in the context of marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Sharing & Disclosure

kg22 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly to the minimum extent necessary for the stated purpose:

• Payment service providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard): To process deposits and withdrawals on your behalf;
• Identity verification providers: To conduct KYC checks and age verification in compliance with our legal obligations;
• Fraud detection and security vendors: To detect and prevent fraudulent activity, account takeover, and money laundering;
• IT infrastructure providers: Hosting, database, and cloud service providers who process data on our behalf under strict data processing agreements;
• Legal and regulatory authorities: Law enforcement agencies, courts, or regulatory bodies where we are legally required to disclose information — for example, in response to a court order or regulatory direction;
• Professional advisors: Lawyers, auditors, and compliance consultants bound by confidentiality obligations, where disclosure is necessary to seek professional advice.

All third-party data processors engaged by kg22 are required to implement appropriate technical and organisational measures to protect personal data, and are prohibited from using it for any purpose other than that for which it was shared.

Data Retention

kg22 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the full duration of your account relationship with kg22, plus a minimum of 5 years following account closure, to satisfy AML and financial record-keeping obligations;
• KYC and identity documents: Retained for a minimum of 5 years from the date of submission or the date of account closure, whichever is later;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Support and communications records: Retained for 3 years from the date of the last interaction, unless the record is relevant to an ongoing dispute;
• Marketing consent records: Retained for the duration of the consent period, plus 1 year after withdrawal of consent to evidence compliance;
• Server and access logs: Retained for up to 12 months for security monitoring purposes, then anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where anonymisation is used, the resulting data may be retained indefinitely for statistical and analytical purposes.

Security Measures

kg22 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and kg22 servers;
• Encryption of sensitive data at rest within our database infrastructure;
• Role-based access controls ensuring that only authorised personnel with a demonstrable operational need can access personal data;
• Multi-factor authentication requirements for all internal administrative accounts;
• Continuous intrusion detection and anomaly-monitoring systems;
• Regular internal and third-party security audits and penetration testing;
• Incident response protocols that require notification to affected users in the event of a data breach that poses a material risk to their rights.

While kg22 takes all reasonable precautions to protect your data, no system is completely immune to attack. You also play a role in protecting your account by keeping your login credentials confidential and notifying us immediately if you suspect any unauthorised access.

Cookies & Tracking Technologies

kg22 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file stored on your device by your browser when you visit a website. The following categories of cookies are used on the kg22 platform:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without impairing platform functionality;
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and display configuration to personalise your experience;
• Analytics cookies: Collect anonymised data about how players interact with the platform — which pages are visited, how long sessions last, and where errors occur — to help us improve performance and usability;
• Security cookies: Support fraud detection systems by recording device characteristics and behavioural signals that help identify anomalous or suspicious activity.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to use the platform. Disabling functional or analytics cookies will not prevent you from accessing games or making transactions. For detailed instructions on managing cookies in popular browsers, refer to your browser's help documentation.

Your Rights

As a kg22 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact the kg22 Privacy team at [email protected]. We will respond to all verified requests within 30 calendar days.

• Right of access: Request a copy of the personal data we hold about you and information about how it is processed;
• Right to rectification: Request correction of inaccurate or incomplete personal data held in your account;
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to restrict processing: Request that we limit how we use your data in certain circumstances, for example while a correction request is under review;
• Right to data portability: Request a structured, machine-readable copy of the personal data you have provided to us, where processing is based on consent or contractual necessity;
• Right to object: Object to processing based on our legitimate interests, including direct marketing communications. We will honour all marketing opt-out requests without delay;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

Please note that some rights may be limited or overridden by our legal obligations — for example, we cannot erase transaction records that we are required by law to retain. In such cases, we will explain the applicable restriction clearly in our response to your request.

Protection of Minors

The kg22 platform is strictly intended for adults aged 21 years and above. kg22 does not knowingly collect personal data from individuals under the age of 21. If we discover, at any point during or after the registration process, that a player is under 21, we will immediately suspend the account, void all associated wagers, and return any real-money deposits to the source payment method after completing the required identity and age verification procedures.

If you believe that a minor has registered an account on the kg22 platform, please contact us immediately at [email protected]. We take the protection of minors extremely seriously and will investigate all such reports with urgency.

International Data Transfers

Some of kg22's technical infrastructure and third-party service providers operate outside of Bangladesh. Where personal data is transferred to a country that may not provide the same level of data protection as Bangladesh, kg22 takes appropriate steps to ensure that such transfers are lawful and that your data remains protected to a standard equivalent to that described in this Policy.

Such measures may include entering into contractual arrangements with the receiving party that impose binding data protection obligations, or relying on the receiving party's membership of a recognised data protection framework. If you would like more information about the safeguards in place for any specific international transfer, please contact us at [email protected].

Changes to This Policy

kg22 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our practices, applicable laws, or platform features. Material changes — meaning those that significantly affect how we collect or use your data, or those that affect your rights — will be communicated to registered players by email at least 7 days before the revised Policy takes effect.

The most current version of this Policy will always be available at kg22.bio/privacy-policy. The "Last Updated" date at the top of this document indicates when the current version became effective. Your continued use of the kg22 platform after the effective date of any revision constitutes your acceptance of the updated Policy.

Contact & Data Requests

For any privacy-related inquiries, data subject access requests, correction requests, erasure requests, or complaints regarding kg22's handling of your personal data, please contact the kg22 Privacy & Compliance team. Our support team operates 24 hours a day, 7 days a week, in English, on Bangladesh Standard Time (BST, UTC+6).

Privacy contact email: [email protected] (plain text — not a clickable link; please copy this address into your email client manually).

When submitting a data request, please include your registered full name, the email address associated with your kg22 account, and a clear description of your request. kg22 will verify your identity before processing any data access or deletion request. We aim to respond to all privacy requests within 30 calendar days. Complex requests may require up to 60 days, in which case we will notify you of the extension within the initial 30-day period.