Privacy Policy 🔐
This document outlines how KukiMuki collects, stores, and uses your personal information in the course of our business.
We take your privacy seriously and are committed to protecting your personal information.
This Privacy Policy is to be read in conjunction with our Terms and Conditions.
By using our website, opening an account, or placing a bet with us, you agree to this Privacy Policy.
We may amend this Privacy Policy at any time by posting an updated version on our website or apps.
By continuing to use our services after changes are made, you accept the revised Policy.
Last Updated: 05 October 2025
1. Who We Are (Controller)
Metaface Limited (Reg. No. 000048317), Sea Urchin Street, San Pedro Town,
Ambergris Caye, Belize, is the data controller for processing related to
www.kukimuki.com (the “Website”). Remote gaming services on the Website are
operated under Anjouan Licence No. ALSI-202507031-FI2 issued by the competent
authority of the Autonomous Island of Anjouan (Union of the Comoros).
This Policy applies globally. Where the GDPR/UK GDPR applies (e.g., for users in the
EEA/UK), we process personal data in accordance with those laws in addition to applicable
Belize/Anjouan requirements and AML/CTF obligations.
2. Scope and Relationship to Other Terms
This Privacy Policy should be read together with our Terms & Conditions and Cookie
Policy. Translations may be provided for convenience; in case of inconsistency, the
English version prevails. By using the Website, creating an account, or placing a bet
with us, you acknowledge this Privacy Policy.
3. Personal Data We Collect
Depending on your interactions with us, we may collect:
• Identification and contact data: name, date of birth, nationality, address, email,
phone.
• Verification (KYC) data: identity documents (passport/ID/driver’s licence), proof of
address (e.g., utility bill), payment method ownership proofs, selfies/liveness checks.
• Financial and transactional data: deposits, withdrawals, balances, chargebacks,
billing details.
• Gameplay and account data: gameplay history, preferences, responsible gambling
settings, bonus participation, loyalty data.
• Technical data: IP address, device identifiers, browser/OS, access logs, session
telemetry.
• Communications: support tickets, call recordings, emails/chats, feedback and
surveys.
• Marketing data: preferences, consent status, campaign interactions.
• Compliance data: sanctions/PEP screening results, fraud-risk indicators, internal
AML/CTF notes limited to what is necessary.
• Professional data (if provided): profession/job title for B2B or affiliate relations.
4. Sources of Personal Data
• Direct interactions: registration, KYC uploads, gameplay, payments, support.
• Third parties: KYC/AML vendors, sanctions/PEP databases, payment processors
and banks, fraud-prevention networks, affiliates/marketing platforms, public records,
and, where lawful, law-enforcement or regulatory bodies.
• Cookies and similar technologies: as described in our Cookie Policy and
Preference Center.
5. Purposes and Legal Bases (GDPR/UK GDPR)
We process personal data on the following legal bases:
• Contract: create/manage your account; provide games; operate wallets; process
payments; support.
• Legal obligation: KYC/AML/CTF checks; sanctions screening; responsible
gambling obligations; record-keeping; tax and regulatory reporting.
• Legitimate interests: service integrity; fraud prevention; network and information
security; service analytics and improvement; limited direct marketing to existing
customers where permitted.
• Consent: email/SMS/IM marketing where required by law; non-essential cookies
and similar technologies; specific promotions. You may withdraw consent at any time
without affecting the lawfulness of prior processing.
6. Screening (AML/CTF, Sanctions, PEP) and Special Categories
For AML/CTF, sanctions and PEP screening, and fraud prevention, we may check
identifiers against sanctions/PEP/watchlists from reputable vendors and public
sources. We do not intentionally process special categories of data (e.g., health data)
except where you provide such data to use responsible gambling tools; in such
cases, we process only what is necessary to deliver those features.
7. Recipients (Categories of Third Parties)
We share personal data with:
• Payment processors and banks (deposits, withdrawals, chargebacks).
• KYC/AML vendors (identity verification, sanctions/PEP screening, liveness).
• Game providers (gameplay delivery, RNG settlement, dispute investigation).
• IT/security and cloud providers (hosting, monitoring, defence).
• Affiliates/marketing platforms (with consent or as permitted by law).
• Supervisory and law-enforcement authorities where legally required.
• Corporate successors in case of merger, acquisition, or asset sale.
All vendors act under data-processing contracts with confidentiality and security
obligations.
8. International Transfers and Safeguards
Where we transfer personal data outside the EEA/UK, we implement appropriate
safeguards such as EU Standard Contractual Clauses and the UK IDTA/Addendum,
together with supplementary measures (e.g., encryption in transit/at rest, access
controls). Storage and processing locations may vary. A copy or summary of
safeguards is available on request.
9. Retention
We keep personal data no longer than necessary for the purposes collected:
• Account/contract data: account lifetime plus 6 years (claims/defence).
• KYC/AML and transactional data: 5–7 years after the business relationship ends
(legal obligation).
• Marketing data: until opt-out/consent withdrawal; thereafter we retain minimal
suppression data to honour your preference.
After expiry, data is deleted or irreversibly anonymised.
10. Security (Technical and Organisational Measures)
We apply measures appropriate to risk, including encryption in transit/at rest, access
controls, segregation of environments, least-privilege access, security monitoring,
incident response, vendor due diligence, and regular testing. Two-Factor
Authentication (2FA) is available for player accounts and strongly recommended.
11. Cookies and Preference Management
We use cookies and similar technologies. Non-essential cookies (analytics/ads) are
used only with your consent. Manage preferences at any time via our Cookie
Banner/Preference Center. See our Cookie Policy for categories, purposes, retention,
and vendors.
12. Marketing Communications
We send marketing communications only with your consent where required by law
(or under legitimate interests where permitted). You can opt out at any time via
account settings or the unsubscribe link. We maintain a suppression list to ensure
your preference is respected.
13. Automated Decisions and Profiling
We use automated tools to detect fraud/abuse, support AML/CTF screening, provide
responsible gambling features (e.g., affordability indicators, session limits), and
manage bonus eligibility. Where required by law, you may request human review,
express your point of view, and contest a decision.
14. Children
Our services are 18+. We do not knowingly collect data from minors. If we learn that
a minor has provided data, we will delete it and close the account. Parents/guardians
may contact privacy@kukimuki.com.
15. Your Rights (EEA/UK where applicable)
You have the right to access, rectification, erasure, restriction, objection (including to
direct marketing), and data portability; and to withdraw consent at any time. You also
have rights related to automated decision-making, including profiling (see Section
13). To exercise your rights, contact privacy@kukimuki.com. We will respond within
one month (extendable by two months for complex requests).
16. Complaints
You can contact us at privacy@kukimuki.com. If you are in the EEA/UK, you may
also lodge a complaint with your local Data Protection Authority. This is in addition to
any gaming-related complaint routes to the Anjouan Supervisory Authority described
in the Terms & Conditions.
17. Responsible Gambling Data
We may process limited behavioural data (e.g., session duration, spend patterns) to
provide responsible gambling tools (reality checks, limits, self-exclusion) on the basis
of legal obligation and/or legitimate interests, as applicable.
18. Business Transfers
In the event of a merger, acquisition, or asset sale, personal data may be transferred
to the successor, subject to continuity of safeguards and this Policy (or an equivalent
policy providing no lesser protection).
19. Unsolicited Information
If we receive personal data we did not request, we will promptly assess whether it is
necessary. If not, we will delete or anonymise it and record the handling for
accountability.
20. Updates to this Policy
We will post updates with a “Last Updated” date and, for material changes, provide
reasonable advance notice (e.g., on-site notice/email). Your continued use after the
effective date indicates acceptance.
21. Contact
Privacy: privacy@kukimuki.com
Support: support@kukimuki.com
Postal: Metaface Limited, Sea Urchin Street, San Pedro Town, Ambergris Caye, Belize