Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy") sets out how Kuda55 (hereinafter referred to as "we", "us", "our", or "the Platform") collects, uses, stores, discloses, and otherwise processes the personal data of individuals (hereinafter referred to as "you", "your", or "the User") who access or use the Kuda55 website at https://kuda55.click and all associated services, features, and functionalities.

Kuda55 is an online gaming platform serving registered players, with a particular focus on the Malaysian market. We understand that privacy is a fundamental expectation of our players, and we are committed to handling all personal data responsibly, transparently, and in accordance with applicable data protection standards.

By registering an account on the Platform, continuing to use our services, or providing your personal information in any context, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform and contact us to close your account.

For the purposes of this Policy, the following terms carry the meanings defined below:

Kuda55 collects only the personal data that is necessary for the provision of our services, fulfilment of our legal obligations, and the protection of our Platform's integrity. The categories of personal data we collect include the following:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for age verification — minimum 21 years of age).
• Email address and chosen username.
• Mobile phone number (where provided for two-factor authentication).
• Residential address and country of residence.
• Preferred currency (Malaysian Ringgit — MYR).

• Copy of government-issued photo identification (Malaysian MyKad, passport, or equivalent).
• Proof of address (bank statement or utility bill issued within the last three months).
• Selfie photograph or video verification (where required by our KYC provider for enhanced verification).

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method used (e.g., Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX).
• Bank account numbers or e-wallet identifiers associated with your verified payment methods.
• Bonus claims, promotional credits applied, and wagering activity records.

• Game session history, including games played, wagers placed, outcomes, and session duration.
• Sports betting market selections, bet sizes, and live betting activity.
• Platform navigation behaviour and feature usage patterns.
• Responsible gambling tool usage (deposit limits set, self-exclusion requests, session timers).

• IP address and approximate geolocation data.
• Device type, operating system, browser type and version.
• Cookie identifiers and session tokens.
• Login timestamps and Platform access logs.

• Records of customer support interactions, including live chat transcripts and email correspondence.
• Feedback submitted through the Platform.
• Survey responses where voluntarily provided.

Kuda55 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit, claim a bonus, contact customer support, or otherwise interact with the Platform.
• Automatically via technical systems: Through cookies, server logs, session tracking technology, and device fingerprinting as you navigate and use the Platform.
• From third-party service providers: Including our licensed KYC identity verification partners, payment processors (such as FPX clearing institutions and e-wallet providers like Touch 'n Go eWallet and GrabPay), and fraud detection services, who may share data with us as part of the service they provide.
• From publicly available sources: Where necessary for AML compliance, sanctions screening, or fraud prevention purposes.

Kuda55 processes your personal data for the following specific purposes:

Kuda55 processes your personal data on one or more of the following legal bases, depending on the specific purpose and context of the processing:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered User — including account management, transaction processing, and service delivery.
• Legal Obligation: Processing required for compliance with applicable laws and regulations, including KYC/AML obligations, age verification requirements, and data retention mandates.
• Legitimate Interests: Processing necessary for purposes such as fraud prevention, Platform security, responsible gambling monitoring, and service improvement — where our legitimate interests are not overridden by your fundamental rights and freedoms.
• Consent: Where you have given explicit consent — for example, to receive promotional communications or to participate in optional analytics programmes. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Kuda55 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following limited and controlled circumstances:

We engage carefully selected third-party service providers who process data on our behalf under binding contractual data processing agreements. These include:

• KYC Identity Verification Providers: To verify your identity and age as required by our compliance obligations.
• Payment Processors: Including institutions facilitating FPX transactions, DuitNow transfers, and e-wallet services (Touch 'n Go eWallet, Boost, GrabPay). These providers receive only the data necessary to process the relevant transaction.
• Fraud Detection & AML Screening Services: To identify and prevent financial crime, sanctions breaches, and account fraud.
• Cloud Infrastructure & Hosting Providers: Who store Platform data on secure, access-controlled servers.
• Customer Support Software Providers: Who facilitate our live chat and ticket management systems.

We may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required to do so by applicable law, court order, or lawful governmental request. We will inform you of any such disclosure to the extent permitted by law.

In the event of a merger, acquisition, restructuring, or sale of all or a portion of Kuda55's business, personal data may be transferred to the relevant successor entity as part of that transaction, subject to the same protections described in this Policy.

Kuda55 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. Our general retention guidelines are as follows:

• Active Account Data: Retained for the duration of the active account relationship and for a period of at least five (5) years following account closure, in accordance with standard AML record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of the last transaction or account closure, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, unless a longer period is required for ongoing dispute resolution.
• Marketing Consent Records: Retained until consent is withdrawn and for a reasonable period thereafter for record-keeping purposes.
• Technical Logs: Retained for twelve (12) months in a form that permits identification, then anonymised or deleted.

Following the expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised such that it can no longer be linked to any individual User.

The Kuda55 Platform uses cookies and similar tracking technologies to ensure the proper functioning of our website, enhance your experience, and generate analytics data that helps us improve our services. The categories of cookies we use are described below:

These cookies are essential for the Platform to function correctly. They enable core features such as session management, account authentication, and secure payment flow. These cookies cannot be disabled without impairing Platform functionality.

These cookies remember your preferences and settings — such as your language preference, session timeout configurations, and responsible gambling tool settings — to provide a more personalised experience on return visits.

We use analytics cookies to understand how Users interact with the Platform — which pages are visited most frequently, where Users exit, and how navigation flows. This data is collected in aggregated, anonymised form and is used solely for service improvement purposes.

You may configure your browser settings to block or delete cookies at any time. Please note that disabling strictly necessary cookies may impair your ability to log in or complete transactions on the Platform. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

As a User of the Kuda55 Platform, you hold the following rights with respect to your personal data. Requests to exercise any of these rights should be directed to our support team via the contact details in Section 15. We will respond to verified requests within a reasonable timeframe and in accordance with applicable law.

Kuda55 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes, but is not limited to, the following:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard 256-bit Secure Socket Layer (SSL) / Transport Layer Security (TLS) protocols.
• Two-Factor Authentication (2FA): Available to all Users as an additional layer of account access security.
• Access Controls: Internal access to personal data is restricted to authorised personnel on a strict need-to-know basis, with access logs maintained and reviewed regularly.
• Encrypted Data Storage: Sensitive data, including KYC documents and financial records, is stored in encrypted format on access-controlled servers.
• Regular Security Audits: The Platform undergoes periodic security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response Protocol: In the event of a data breach that poses a risk to User rights and freedoms, we maintain a documented incident response process and will notify affected Users and relevant authorities in accordance with applicable law.

Whilst we take all reasonable steps to safeguard your data, no digital system is entirely immune to security risks. You are also responsible for maintaining the security of your own account credentials and should notify us immediately if you suspect any unauthorised access to your Kuda55 account.

The Kuda55 Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, process, or store the personal data of any person under the age of 21.

Age verification is a mandatory component of our KYC process. Any User who is found to have misrepresented their age during registration will have their account immediately suspended, all funds returned where appropriate, and their data deleted from our systems as expeditiously as practicable, subject to any legal retention obligations that may apply.

If you believe that a minor has registered on the Platform or that we have inadvertently collected data from a person under 21, please contact our support team immediately so that we can take the appropriate corrective action.

The Kuda55 Platform may reference or integrate with third-party services in the course of providing our services — for example, the processing infrastructure of Malaysian payment methods such as DuitNow, FPX, and registered e-wallet providers. These third-party services operate under their own privacy policies and terms of service, which are independent of this Policy.

Kuda55 is not responsible for the privacy practices or data handling procedures of any third-party service provider beyond the scope of the data processing agreements we hold with them as Data Processors. We encourage you to review the privacy policies of any third-party payment provider or service whose platform you access in connection with your use of Kuda55.

Kuda55 reserves the right to revise, update, or replace this Privacy Policy at any time in response to changes in applicable law, regulatory requirements, our business operations, or technological developments. The date of the most recent revision is stated prominently at the top of this page.

Where changes to this Policy are material — meaning they meaningfully affect how we use your personal data — we will notify registered Users via email and/or a notification displayed on the Platform at least seven (7) days before the change takes effect, unless a shorter notice period is required by law.

Your continued use of the Platform following the publication of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and contact us to close your account and request data erasure where applicable.

For any enquiries, concerns, complaints, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Kuda55 Data Protection team through the following channels:

• Live Chat: 24/7 live chat support is available directly through the Platform and is the fastest channel for urgent privacy queries.
• Email: [email protected] — please include "Privacy Request" in the subject line for prioritised handling. (Plain text — not a clickable link.)

We aim to acknowledge all written privacy requests within two (2) business days and to resolve them fully within thirty (30) calendar days, or within the shorter period required by applicable law. For complex requests, we may notify you that an extension of up to an additional sixty (60) days is required, along with the reasons for the extension.

We are committed to resolving all privacy concerns internally in the first instance. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection authority in your jurisdiction.