kc22 Privacy Policy — How Your Data Is Kept Secure

01What Types of Data kc22 Collects

Kc22 collects only the data that is genuinely necessary for platform operation, security, and service improvement. Collecting unnecessary data is against kc22's policy.

02How Collected Data Is Used

Kc22 uses collected data solely for specific purposes — nothing beyond that. Key use cases include:

• Account management: For registration, login, password reset, and account verification.
• Transaction processing: To confirm deposits and withdrawals and display transaction history.
• Security: To detect unusual account activity and prevent fraud.
• Support: Account history is reviewed in order to provide an accurate response to your complaint or query.
• Legal Obligations: To respond to lawful requests from authorities.
• Service Improvement: Usage patterns are analyzed to improve the platform experience — without being linked to any personal identity.

03Who Your Data Is Shared With

Kc22 takes a cautious approach to data sharing. Information is never shared with any party except in the specific circumstances outlined below:

• Payment processor: Only the transaction details necessary for deposit and withdrawal verification are sent to the bKash/Nagad/Rocket system. Your full account profile is never shared.
• Technology partners: Hosting and security service providers may access limited data solely for operational purposes — they are also bound by kc22's confidentiality agreement.
• Legal authorities: If kc22 receives a court order or a lawful request from a regulatory authority, the required information may be disclosed — and only exactly what has been requested.
• In an emergency: Where there is a risk to the life of a member or any other person, relevant information may be disclosed to the appropriate authorities.

04Special Protection for Payment Data

Financial data is the most sensitive kind — kc22 understands this fully. Here's what we do to protect your payment information:

• The PIN you enter in your mobile banking app during a deposit never reaches kc22's servers — it is processed directly through the payment network.
• Kc22's database stores only transaction reference numbers, amounts, and timestamps.
• PCI DSS (Payment Card Industry Data Security Standard) compliance is strictly maintained.
• No staff member can view your full mobile number or payment details — these are only visible in masked format (e.g., 017××××××90).

05Cookie & Session Management

Kc22 uses cookies on its website — but strictly only what is genuinely necessary. There are absolutely no advertising cookies.

• Session Cookies: To maintain your login session. Cleared when the browser is closed.
• Security cookies: To prevent CSRF attacks and detect suspicious login attempts.
• Preference cookies: To remember your language and interface preferences.

You can disable cookies from your browser settings — however, this may affect how your login session functions.

06Technical Security Measures

Kc22's infrastructure employs multiple layers of security to keep member data protected:

• Firewall & DDoS Protection: Enterprise-grade firewalls are in place to prevent unauthorized access and attacks on servers.
• Two-factor authentication (2FA): Members can enable 2FA on their account — this keeps your account secure even if your password is compromised.
• Activity log: Every login, payment, and significant activity is logged — and you can view this log yourself.
• Automated Alerts: If a login attempt is detected from an unusual location or device, an SMS alert is sent to your registered number.
• Penetration testing: Twice a year, independent security experts audit the system for vulnerabilities and submit a report.

07Your Data Rights

Every kc22 member has certain rights over their own data. To exercise any of these rights, simply contact our support team.

08How Long Your Data Is Retained

Kc22 does not retain data longer than necessary. Key guidelines for retention periods:

• Active Account: Necessary data is retained for as long as the account remains active.
• Transaction records: Transaction data must be retained for 5 years for legal and financial audit purposes.
• KYC Documents: Retained for 5 years as required under licensing regulations.
• Other data from closed accounts: Data beyond legal obligations is deleted within 90 days of account closure.
• Support Conversations: Deleted 2 years after resolution.

09Protection of Minors

Kc22 strictly refrains from serving anyone under 18 and enforces a zero-tolerance policy on this.

• Date of birth is verified at the time of registration, and ID documentation may be requested in suspicious cases.
• Kc22 does not intentionally collect any data from minors.
• Any account identified as belonging to a minor is immediately closed and all balances are refunded.
• If a parent suspects their child is using kc22, they should immediately Help Center let us know.

10Privacy Policy Updates

Kc22 may update this Privacy Policy when necessary. How changes will be communicated:

• If significant changes are made, an SMS will be sent to your registered mobile number.
• The "Last Updated" date at the top of the page will reflect any changes.
• Members will have the opportunity to review changes before they take effect.
• Continued use of the platform after changes take effect will be considered acceptance of the updated policy.