Privacy Policy — How 9wkt Handles Your Personal Data

1. Information We Collect

1.1 Information You Provide Directly

When you register an account or interact with 9wkt's services, you provide us with information directly. The categories of personal data we collect at this stage include:

• Identity data: Full legal name, date of birth, nationality, and government-issued ID details (National ID card, passport, or driving licence number) collected during Know Your Customer (KYC) verification.
• Contact data: Registered mobile phone number (used for OTP authentication and account communications) and email address.
• Address data: Residential address, including district, division, and postcode, as provided during registration or verification.
• Financial data: Mobile Financial Service (MFS) account identifiers for bKash, Nagad, Rocket, and Upay; bank account details where bank transfer is selected. Full payment credentials are never stored on 9wkt systems — they are tokenised via our payment processing partners.
• Account credentials: Your chosen username and a hashed (non-recoverable) representation of your password. We never store passwords in plaintext.

1.2 Information Collected Automatically

When you access the 9wkt platform, certain technical and behavioural data is collected automatically by our systems. This includes:

• Device and browser data: IP address, device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and preferred language setting.
• Usage and session data: Pages visited, time spent on each page, navigation path through the platform, search queries entered, games launched, bets placed, deposit and withdrawal session timestamps, and session duration.
• Location data: Approximate geographic location derived from IP address. We do not request or access your device's GPS location.
• Log data: Server-side access logs that record the date, time, and nature of requests made to the 9wkt platform infrastructure.

1.3 Information from Third Parties

In certain circumstances, 9wkt may receive information about you from third parties. This includes identity verification results returned by our KYC partners, fraud risk scores provided by payment processing partners, and account linkage information where you choose to log in via a third-party authentication provider. All such information is subject to the same protections described in this Privacy Policy.

The table below summarises the primary data categories, their sources, and the legal basis under which 9wkt processes them:

2. How We Use Your Data

2.1 Core Platform Operations

The primary purpose for which 9wkt processes your personal data is to provide and maintain the betting and casino services you have registered to use. Specifically, this includes: creating and managing your account; processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer; settling bets and crediting winnings; verifying your identity and age to comply with responsible gaming obligations; and providing customer support via email when you raise a query or complaint.

2.2 Fraud Prevention and Security

9wkt uses account data, device fingerprinting, IP analysis, and transaction pattern monitoring to detect and prevent fraud, money laundering, match fixing, bonus abuse, and unauthorised account access. Where suspicious activity is identified, your account may be temporarily restricted while an investigation is conducted. We may share relevant data with law enforcement or regulatory authorities if required by applicable law or if we determine that a serious criminal matter has occurred.

2.3 Responsible Gaming Compliance

Behavioural and session data is used by 9wkt's responsible gaming systems to monitor for signs of problem gambling. This includes tracking session length, deposit frequency, net loss amounts, and changes in betting patterns. Where our systems detect behaviour consistent with problematic gambling, we may proactively reach out to the player concerned with responsible gaming resources. This processing is carried out in your interest and in compliance with our responsible gaming obligations.

2.4 Communications and Marketing

9wkt may send you transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and important policy updates — without requiring separate consent, as these are necessary to fulfil our contractual obligations to you. Promotional communications (bonus offers, seasonal promotions, new game announcements) will only be sent where you have opted in to marketing at the time of registration or through Account Settings. You may withdraw your marketing consent at any time by updating your notification preferences in Account Settings or by emailing [email protected].

2.5 Platform Improvement and Analytics

Aggregated and anonymised usage data is analysed by 9wkt to understand how the platform is being used, to identify technical issues, to improve navigation and user experience, and to inform decisions about new features and betting markets. Where analytics data is aggregated, it cannot be used to identify any individual player.

3. Data Sharing and Disclosure

3.1 Service Partners

9wkt works with a limited number of third-party service partners who process personal data on our behalf in order to deliver the platform's core functionality. All service partners are subject to written data processing agreements that restrict their use of your data strictly to the purposes for which it was shared. Current categories of service partner include:

• Payment processors: bKash, Nagad, Rocket, Upay, and banking partners process transaction data to facilitate deposits and withdrawals.
• KYC and identity verification providers: Specialist third-party providers conduct document verification and liveness checks in connection with our age and identity verification obligations.
• Game providers: Third-party game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, and Spribe receive a session token and account identifier to initialise game sessions. They do not receive your full name, payment details, or ID documents.
• Fraud and AML screening services: Risk scoring and transaction monitoring partners receive transaction metadata to assist in identifying suspicious activity.
• Cloud infrastructure and hosting: 9wkt's platform is hosted on enterprise-grade cloud infrastructure. Our hosting partner processes server-level log data as part of infrastructure management.

3.2 Legal Disclosures

9wkt may disclose your personal data to governmental authorities, law enforcement agencies, or regulatory bodies where we are required to do so by applicable law, court order, or regulatory direction. We will not disclose more information than is strictly required by the specific legal obligation or request. Where permitted by law, we will attempt to notify you of such a disclosure unless doing so would compromise an ongoing investigation.

3.3 Business Transfers

In the event that 9wkt's business is acquired, merged with another entity, or undergoes a significant corporate restructuring, personal data held by 9wkt may be transferred to the successor entity as part of that transaction. In such an event, we will notify affected players in advance and ensure that the successor entity is bound by equivalent data protection obligations to those described in this Privacy Policy.

4. Cookies and Tracking Technologies

4.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits, remember your preferences, and maintain your session state while you are logged in. 9wkt uses cookies and similar technologies (such as local storage and session storage) to operate the platform.

4.2 Categories of Cookies Used by 9wkt

• Essential cookies: Required for the platform to function. These include session management cookies that keep you logged in, security tokens that protect against cross-site request forgery (CSRF), and load balancing cookies. You cannot opt out of essential cookies while using the platform.
• Functional cookies: Remember your preferences such as preferred language setting, odds format, and display options. These improve your experience but are not strictly required for core functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how players use the 9wkt platform. This data helps us identify navigation issues and improve the overall experience. 9wkt uses a self-hosted analytics solution; your usage data is not shared with third-party analytics platforms.
• Responsible gaming cookies: Track session duration and login frequency on your device to support our responsible gaming monitoring systems. These cookies are classified as essential due to their role in player protection.

4.3 Managing Cookies

You can configure your browser to block, delete, or alert you to the use of cookies. Instructions for managing cookies in common browsers (Chrome, Firefox, Safari, Edge) are available in each browser's help documentation. Please note that blocking essential cookies will prevent you from logging in and using the 9wkt platform. Blocking functional or analytics cookies will not affect your ability to place bets or access games but may reduce the quality of your experience.

5. Data Retention and Storage

5.1 Retention Periods

9wkt retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable legal or regulatory obligations. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of the account relationship plus a minimum of 5 years following account closure, to satisfy AML record-keeping requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping obligations.
• Betting history: Retained for a minimum of 3 years from the date of each bet for dispute resolution purposes.
• Support correspondence: Retained for 3 years from the date of the final communication in any given support thread.
• Marketing preferences and consent records: Retained for the duration of the account relationship plus 1 year following account closure.
• Analytics data: Aggregated and anonymised within 90 days of collection; anonymised data may be retained indefinitely.

5.2 Data Storage Location

9wkt's primary data storage infrastructure is hosted within secure data centres. Personal data is stored on servers that are protected by physical security controls, network firewalls, intrusion detection systems, and access control policies that restrict access to authorised personnel only. Where data is transferred to or accessed by service partners outside the primary hosting jurisdiction, such transfers are governed by appropriate data transfer mechanisms and contractual safeguards.

5.3 Secure Deletion

When personal data is no longer required and has reached the end of its applicable retention period, 9wkt securely deletes or anonymises that data using industry-standard data destruction methods. For digital records, this involves cryptographic erasure or secure overwriting of storage media. Anonymised data, from which no individual can be identified, may be retained for statistical and analytical purposes indefinitely.

6. Security Measures

6.1 Technical Safeguards

9wkt implements a comprehensive set of technical security controls to protect your personal data against unauthorised access, accidental loss, and malicious attack. These include AES-256 encryption for data at rest; TLS 1.3 for all data in transit; bcrypt hashing with salting for all stored passwords; two-factor authentication (2FA) available to all players via OTP to registered mobile number; web application firewall (WAF) protection; regular automated vulnerability scanning; and penetration testing conducted by independent security specialists.

6.2 Organisational Safeguards

Access to personal data within 9wkt's organisation is restricted on a strict need-to-know basis. Support staff and operations personnel are granted the minimum level of data access required to perform their role. All personnel with access to personal data are subject to confidentiality obligations and receive regular data protection training. Access permissions are reviewed and updated at least every six months.

6.3 Data Breach Response

In the event of a confirmed data breach that may pose a risk to your rights or interests, 9wkt will take immediate steps to contain the breach, assess its scope, and notify affected players without undue delay. Notifications will be sent to the email address registered on your account and will include a description of the nature of the breach, the data categories affected, the likely consequences, and the measures 9wkt has taken or intends to take in response.

7. Your Privacy Rights

7.1 Right to Access

You have the right to request a copy of the personal data that 9wkt holds about you at any time. Access requests should be submitted in writing to [email protected] with the subject line "Data Access Request". We will respond within 30 days of receiving a valid request. To protect your data, we will verify your identity before fulfilling any access request.

7.2 Right to Rectification

If any personal data held by 9wkt about you is inaccurate or incomplete, you have the right to request that it be corrected. Many data fields (such as contact number and email address) can be updated directly through Account Settings. For identity data that was verified during KYC (such as legal name and date of birth), corrections must be submitted with supporting documentary evidence and processed by the support team.

7.3 Right to Erasure

You may request deletion of your personal data where: the data is no longer necessary for the purpose it was collected; you have withdrawn your consent and no other legal basis exists; or the data has been processed unlawfully. Please note that 9wkt cannot delete data that it is legally required to retain — for example, transaction records subject to a 5-year AML retention obligation. Where full deletion is not possible, we will inform you of what data must be retained and why, and delete all remaining data that is not subject to a legal hold.

7.4 Right to Data Portability

Where technically feasible, you may request an export of your personal data in a structured, machine-readable format (CSV or JSON). This right applies to data that you have provided to us directly and that we process on the basis of consent or contractual necessity. Portability requests should be submitted to [email protected].

7.5 Right to Withdraw Marketing Consent

Where you have opted in to receive marketing communications from 9wkt, you may withdraw that consent at any time without affecting the lawfulness of marketing sent prior to withdrawal. To unsubscribe, update your notification preferences in Account Settings, click the unsubscribe link in any marketing email, or contact [email protected].

7.6 Right to Object

You have the right to object to 9wkt's processing of your personal data where that processing is based on legitimate interest. Where you raise an objection, 9wkt will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

8. Contact and Policy Updates

8.1 How to Contact Us About Privacy

For any privacy-related queries, data rights requests, or concerns about the way 9wkt processes your personal data, please contact our support team directly:

• Email: [email protected] (subject line: "Privacy Query" or "Data Rights Request")
• Response time: We aim to acknowledge all privacy queries within 3 business days and provide a full response within 30 calendar days.

8.2 Changes to This Privacy Policy

9wkt reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make a material change to this policy, we will update the "Last Updated" date at the top of this page and, where the change is significant, notify you via email to your registered address. Continued use of the 9wkt platform after a policy update constitutes your acceptance of the revised terms. We encourage you to review this page periodically.

8.3 Relationship to Other Policies

This Privacy Policy should be read alongside the Terms & Conditions and the Responsible Gaming policy, which together form the complete framework governing your use of the 9wkt platform. In the event of any conflict between this Privacy Policy and the Terms & Conditions regarding the handling of personal data, this Privacy Policy shall prevail.

For all privacy-related matters, please write to: [email protected]