Privacy Policy — How k499 Protects Your Data

Last Updated: January 2026 — Version 2.4

1. Information We Collect

k499 collects personal information about you through several channels: directly from you when you register or update your account, automatically as you use the platform, and from third-party partners involved in payment processing and identity verification. The categories of personal data we collect are set out below.

1.1 Registration & Account Data

When you create a k499 account, we collect the information you provide during the registration process, which includes:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (used to verify that you are aged 18 or above)
• Mobile phone number (used as your primary contact and for OTP authentication)
• Email address (used for account notifications and support communications)
• Username and encrypted password
• Residential address in Bangladesh (city, district, division)

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) obligations and to prevent fraud, money laundering, and underage gambling, k499 may request the following documents from players at any stage of their account lifecycle:

• Scanned copy or photograph of a government-issued National Identity Card (NID) or passport
• Proof of address document (e.g., utility bill or bank statement issued within the past three months)
• Proof of payment method ownership (e.g., screenshot of registered bKash or Nagad account showing your name and mobile number)
• Source of funds declaration for high-volume accounts

1.3 Financial Transaction Data

When you make deposits or withdrawals on k499, we collect transactional records including:

• Mobile wallet number (bKash, Nagad, Rocket, or Upay) — stored in masked form after verification
• Transaction reference IDs generated by the payment gateway
• Deposit and withdrawal amounts, timestamps, and statuses
• Card type indicator (Visa or Mastercard) and last four digits, where card payments are used

k499 does not store full card numbers or mobile wallet PINs. All sensitive payment credentials are processed directly by the respective payment provider and are not transmitted to or stored on k499's servers.

1.4 Gameplay & Betting Activity Data

k499 maintains detailed records of all betting and gaming activity conducted through your account. This includes:

• Bets placed, including sport/market, stake amount, odds, and settlement outcome
• Casino and slot game sessions, including game name, session duration, stake amounts, and results
• Multi-bet accumulator selections and outcomes
• Bonus offers accepted, wagering progress, and bonus expiry records

This data is retained for operational, financial audit, and responsible gaming purposes. It enables k499 to identify and support players who may be exhibiting signs of problematic gambling behaviour.

1.5 Technical & Device Data

When you access k499 through a web browser or mobile device, we automatically collect certain technical information, including:

• IP address (used for geolocation, fraud detection, and duplicate account identification)
• Device type, operating system, and browser type and version
• Device fingerprint (a composite identifier derived from device characteristics, used for fraud prevention)
• Session start and end timestamps
• Pages visited, features accessed, and click-path data within the platform
• Referral URL (the address of the webpage from which you arrived at k499, if applicable)

1.6 Customer Support Communications

When you contact k499 support through live chat or email at [email protected], we retain a record of the conversation, including the content of your messages, timestamps, the support agent who handled the query, and the resolution provided. These records are used to ensure service quality, resolve disputes, and train support staff.

2. How We Use Your Data

k499 uses your personal data exclusively for the purposes set out below. We do not use your data for any purpose that is incompatible with the reason it was originally collected without obtaining your prior consent.

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, contact details	Contract performance
Age and identity verification (KYC)	KYC documents, date of birth	Legal obligation; platform security
Processing deposits and withdrawals	Financial transaction data, payment method identifiers	Contract performance
Fraud detection and account security	IP address, device fingerprint, transaction patterns	Legitimate interest
Responsible gaming monitoring	Gameplay data, session frequency, deposit patterns	Legal obligation; player welfare
Customer support	Support communication records, account data	Contract performance; legitimate interest
Platform improvement and analytics	Anonymised usage data, click-path data	Legitimate interest
Promotional communications (opt-in only)	Contact details, gameplay preferences	Consent

Marketing Communications

k499 will only send you promotional emails or SMS notifications about new games, bonus offers, cricket betting promotions, or seasonal campaigns (such as Eid or BPL season promotions) if you have explicitly opted in to receive such communications during registration or through your account settings. You may withdraw your marketing consent at any time by contacting support at [email protected] or by updating your notification preferences within your account.

3. Data Sharing & Disclosure

k499 does not sell your personal data to any third party. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

3.1 Payment Processing Partners

To process your deposits and withdrawals, k499 shares the minimum required payment information with authorised payment gateway partners including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. These partners operate under their own privacy policies and are bound by contractual data processing agreements with k499 that restrict how they may use your information.

3.2 Game Technology Providers

k499's casino and sports betting games are powered by third-party game studios and technology providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive session tokens or anonymous player identifiers to serve game content. They do not receive your full name, payment details, or contact information.

3.3 Identity Verification Services

Where k499 uses a third-party KYC service provider to assist with document verification, your identity documents will be transmitted to that provider in encrypted form. The provider is contractually obligated to use your documents solely for verification purposes and to delete them after verification is complete.

3.4 Legal & Regulatory Disclosure

k499 may be required to disclose your personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where we are legally compelled to do so by a valid court order, regulatory demand, or applicable law. In such cases, k499 will disclose only the data that is specifically requested and will notify the player of such a disclosure where we are legally permitted to do so.

3.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of k499's business assets, player data may be transferred to the acquiring entity as part of the transaction. In such a scenario, affected players will be notified via on-platform notification and the new data controller will be identified. Players will retain the right to request deletion of their data following any such transfer.

4. Cookies & Tracking Technologies

k499 uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your login session, and to gather anonymised analytics data about how the platform is used. The categories of cookies used by k499 are described below.

4.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They include session cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery (CSRF), and cookies that remember your language and display preferences. No personal data other than a session identifier is stored in strictly necessary cookies.

4.2 Analytics Cookies

k499 uses anonymised analytics tools to understand how players navigate the platform, which features are most used, and where technical errors occur. Analytics cookies collect data in aggregated, non-personally-identifiable form. This data is used solely to improve the platform experience and is never used to identify individual players or target advertising.

4.3 Fraud Prevention Cookies

To detect and prevent fraudulent activity — including duplicate account creation and unauthorised login attempts — k499 uses fraud-detection cookies and device fingerprinting scripts. These tools generate an anonymous device identifier that is compared against known fraud patterns. They do not store any payment information or sensitive personal data.

4.4 Managing Cookies

You can control and manage cookies through your web browser settings. Most browsers allow you to block or delete cookies at any time. Please be aware that disabling strictly necessary cookies will impair the functionality of the k499 platform and may prevent you from logging in or completing transactions. Disabling analytics or fraud-prevention cookies may limit k499's ability to detect fraudulent activity on your account.

5. Data Retention Periods

k499 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or audit obligations. The table below summarises our standard retention periods by data category.

Data Category	Retention Period	Basis for Retention
Account registration data	Duration of account + 5 years post-closure	Legal obligation; dispute resolution
KYC identity documents	Duration of account + 5 years post-closure	Anti-money laundering obligations
Financial transaction records	7 years from transaction date	Financial audit and legal requirements
Gameplay and betting history	5 years from account closure	Responsible gaming; dispute resolution
Customer support communications	3 years from last interaction	Service quality; dispute records
Technical and device logs	12 months from collection	Security monitoring; fraud detection
Marketing consent records	Until consent is withdrawn + 2 years	Compliance with consent requirements

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from k499's systems or anonymised such that it can no longer be linked to any individual player. Anonymised data may be retained indefinitely for statistical and platform improvement purposes.

6. Data Security Measures

k499 implements a layered data security framework designed to protect your personal information against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include the following controls.

Technical Controls

• 256-bit SSL/TLS encryption for all data in transit between your device and k499's servers.
• AES-256 encryption at rest for sensitive data fields including passwords (stored as salted hashes), KYC documents, and payment identifiers.
• Two-factor authentication (2FA) available for all player accounts via OTP sent to the registered mobile number.
• Rate limiting and brute-force protection on all login and password reset endpoints.
• Continuous intrusion detection monitoring on all k499 server infrastructure.

Organisational Controls

• Access to player personal data is restricted to authorised personnel with a documented operational need. All access is logged and subject to periodic audit.
• All k499 staff with access to player data are required to complete data privacy and security training.
• Third-party service providers handling player data are vetted for security compliance and are bound by contractual data processing agreements.
• k499 conducts periodic security assessments and penetration testing of its platform infrastructure.

7. Your Privacy Rights

As a k499 player, you hold the following rights over your personal data. To exercise any of these rights, please contact the k499 support team at [email protected]. k499 will respond to all valid privacy rights requests within 10 business days.

Right of Access

You have the right to request a copy of all personal data that k499 holds about you. Upon a valid access request, k499 will provide you with a structured summary of your data, the purposes for which it is processed, the categories of recipients it has been shared with, and the applicable retention periods.

Right to Rectification

If any personal data that k499 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update many of your account details directly through your account settings page. For changes to core identity information (such as your registered name or date of birth), contact support and provide the relevant supporting documentation.

Right to Erasure

You have the right to request the deletion of your personal data in circumstances where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent was the basis for processing), or where the data has been unlawfully processed. Please note that this right is subject to k499's legal obligations to retain certain data categories — particularly financial transaction records and KYC documents — for defined regulatory periods, even after account closure. k499 will inform you of any retention obligations that limit the scope of a deletion request.

Right to Restriction of Processing

You have the right to request that k499 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of your data is being verified following a rectification request, or while a complaint about k499's processing practices is being investigated. During a restriction period, k499 will continue to store your data but will suspend active processing of it.

Right to Data Portability

Where your data has been processed on the basis of your consent or on the basis of contract performance, you have the right to receive a copy of your personal data in a structured, machine-readable format. k499 can provide account and transaction data exports in CSV format upon request.

Right to Object to Marketing

You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time. Upon receipt of a marketing opt-out request, k499 will cease all promotional communications to you within 5 business days. This will not affect transactional communications related to your account (such as deposit confirmations, withdrawal notifications, or security alerts), which are operationally necessary and not classified as marketing.

8. Policy Updates & Contact

Updates to This Policy

k499 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. When material changes are made, we will update the "Last Updated" date at the top of this document and, where reasonably practicable, notify active players via an on-platform notification. Continued use of the k499 platform following publication of an updated Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how k499 protects your information.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about how k499 has handled your personal data, please contact the k499 data privacy team directly at: [email protected]

k499 takes all privacy complaints seriously. Upon receipt of a complaint, we will acknowledge it within 2 business days and aim to provide a full response within 10 business days. Where an investigation is complex, we will keep you informed of progress throughout the process.