Privacy Policy —
How kiss918 Protects Your Data

1. Information We Collect

kiss918 collects personal information through several channels: directly from you during account registration and KYC verification, automatically through your use of the Platform, and in limited cases from trusted third-party service providers. We collect only the minimum data necessary to deliver our services safely, fairly, and in compliance with applicable requirements. The categories of information we collect are described below.

1.1 Information You Provide Directly

When you register an Account, complete KYC, make a deposit, or contact our support team, you may provide us with the following information:

1.2 Information Collected Automatically

When you access or use the kiss918 Platform, our systems automatically collect certain technical and behavioural information, including:

• Device and Connection Data: IP address, device type and model, operating system and version, browser type and version, screen resolution, and language settings;
• Usage and Behavioural Data: Pages visited, games launched, bets placed, session duration, click-path data, and feature interactions within the Platform;
• Transaction Logs: Timestamped records of all deposits, withdrawals, wagers, and bonus activations associated with your Account;
• Cookie and Tracking Data: Session identifiers, preference cookies, and analytics data as described in Section 4 (Cookies and Tracking Technologies) of this Policy.

1.3 Information from Third Parties

In limited circumstances, kiss918 may receive information about you from trusted third-party sources, including:

• Payment Processors: Transaction status confirmations and fraud-risk signals received from bKash, Nagad, Rocket, Upay, and partnered banks (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank);
• Identity Verification Providers: Pass/fail signals from third-party document verification services used to support our KYC process — we do not receive raw biometric data from these providers;
• Fraud Prevention Services: Device fingerprint risk scores and IP reputation data used to detect multi-accounting and fraudulent activity.

3. Data Sharing and Third Parties

kiss918 does not sell, rent, or otherwise trade your personal information to external parties for their own commercial use. We share your data only in the limited, specific circumstances described below, and only with parties who are contractually bound to handle it securely and in accordance with applicable data protection principles.

3.1 Service Providers

We engage carefully selected third-party service providers who process personal data on our behalf solely to support the delivery of the kiss918 Platform:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank — receive transaction-level data necessary to process deposits and withdrawals;
• KYC / Identity Verification Providers: Receive document images and selfie data to carry out automated identity and liveness checks;
• Cloud Hosting and Infrastructure Providers: Store encrypted Platform data, account records, and transaction logs in secure data centres;
• Fraud Prevention and AML Analytics Providers: Receive anonymised device and behavioural signals to produce risk scores;
• Customer Support Software: Hosts support ticket data and live chat transcripts to enable efficient resolution of player queries.

All service providers operate under data processing agreements that restrict their use of your data strictly to the purposes for which it was shared and require them to maintain appropriate security measures.

3.2 Game Content Providers

kiss918 integrates games from leading providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game, a session token and anonymised player identifier are passed to the relevant provider to load the game and record the outcome. Full personal identity data is not shared with game providers. Game session results are returned to kiss918 and recorded in your transaction log.

3.3 Legal and Regulatory Disclosures

kiss918 may disclose personal information to competent authorities, law enforcement bodies, or regulatory agencies where we are legally required to do so, where disclosure is necessary to prevent or detect fraud or financial crime, or where disclosure is required to comply with a valid legal order. We will notify you of any such disclosure where we are lawfully permitted to do so.

5. Data Security and Storage

kiss918 implements a multi-layered security framework designed to protect your personal information against unauthorised access, disclosure, alteration, and destruction. Our security practices are reviewed and updated on a regular basis in line with evolving industry standards.

5.1 Technical Security Measures

• TLS/SSL Encryption in Transit: All data transferred between your browser or app and our servers is encrypted using TLS 1.2 or higher;
• AES-256 Encryption at Rest: Sensitive personal data — including KYC documents, NID references, and financial identifiers — is stored using AES-256 encryption in our database layer;
• Password Hashing: Account passwords are hashed using a strong one-way cryptographic function (bcrypt) and are never stored in plain text;
• Payment Tokenisation: bKash, Nagad, and bank account references are tokenised; full account numbers are not retained in our primary database after the tokenisation process is complete;
• Firewall and Intrusion Detection: Our infrastructure is protected by Web Application Firewalls (WAF), DDoS mitigation services, and automated intrusion detection systems;
• Access Controls: Access to personal data within kiss918's internal systems is restricted on a strict need-to-know basis, with role-based access controls and comprehensive access logging.

5.2 Organisational Security Measures

• All personnel with access to player data are subject to confidentiality obligations;
• Internal data access is logged and audited regularly;
• KYC document images are stored in isolated, access-controlled storage buckets separate from the main application database;
• Security incidents are managed through a documented incident response procedure, and affected Players will be notified without undue delay where a breach is likely to result in a risk to their rights or interests.

7. Data Retention Policy

kiss918 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce our agreements. The table below summarises our standard retention periods by data category.

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. KYC document images stored in isolated storage buckets are overwritten using a certified secure deletion process. Anonymised aggregated data (for example, game popularity statistics) may be retained indefinitely as it cannot be used to identify any individual.