Privacy Policy

This Privacy Policy ("Policy") describes how kp66 ("we", "us", "our", "the Controller") collects, uses, stores, shares and protects personal data relating to users ("you", "your") of the kp66 platform, including all associated websites, mobile applications and digital services accessible at https://kp66.cam/ (collectively, the "Platform").

kp66 is an English-language online gaming information and gaming services platform designed primarily for users in Pakistan and other English-speaking markets. We process personal data in accordance with the data protection laws applicable under our operating jurisdiction and, where applicable, internationally recognised data protection principles including those set out in the EU General Data Protection Regulation (GDPR) as a baseline standard of good practice.

This Policy applies to all visitors, registered users and any person who interacts with the Platform in any capacity. It should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

Throughout this Policy, the following terms carry the meanings set out below:

• Personal Data: Any information that relates to an identified or identifiable natural person. This includes, but is not limited to, names, email addresses, IP addresses, payment details and account credentials.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, erasure or destruction.
• Controller: The entity that determines the purposes and means of processing personal data. kp66 acts as the Controller for data processed under this Policy.
• Processor: A third party that processes personal data on behalf of the Controller under documented instructions.
• Data Subject: The natural person to whom personal data relates — in the context of this Platform, the User.
• Cookies: Small text files placed on a user's device by a website to store information about browsing activity, preferences and session state.
• KYC: Know Your Customer — the identity and document verification process conducted to satisfy regulatory and anti-money laundering obligations.

kp66 collects personal data across the following categories, depending on how you interact with the Platform:

We do not intentionally collect special category data (such as health information, religious beliefs or political opinions) unless strictly required by applicable regulatory obligations and with appropriate safeguards in place. We do not collect data from persons we know to be under the age of 18.

We collect personal data through the following channels:

• Direct interactions: Information you provide when creating an Account, completing KYC, making a deposit or withdrawal, contacting support or filling in any form on the Platform.
• Automated technologies: Cookies, server logs, pixel tags and similar tracking technologies collect technical and usage data automatically as you navigate the Platform.
• Third-party sources: We may receive identity verification data from KYC service providers, fraud prevention agencies and payment processors such as those facilitating transactions via Easypaisa, JazzCash or bank transfer references. These are shared for verification and fraud-prevention purposes only.
• Responsible gambling tools: If you voluntarily set deposit limits, loss limits, cooling-off periods or self-exclusion, we record these preferences as part of your Account data to give effect to your choices.

Where international data protection standards apply, we rely on the following legal bases to process your personal data:

• Contract performance: Processing necessary to provide you with the Platform's services, manage your Account and process transactions.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, KYC obligations and regulatory reporting requirements.
• Legitimate interests: Processing for fraud prevention, platform security, service improvement and analytics, where such interests are not overridden by your fundamental rights.
• Consent: Processing for non-essential cookies, marketing communications and optional feature personalisation, where you have provided clear and affirmative consent. You may withdraw consent at any time.

kp66 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining and securing your Account; processing login authentication; responding to Account-related requests.
• Service delivery: Processing deposits, withdrawals and bonus credits; providing access to games and betting markets; delivering customer support.
• Regulatory compliance: Conducting KYC and AML checks; verifying age and eligibility; meeting reporting obligations under applicable licence conditions.
• Fraud and security: Detecting and preventing fraudulent activity, unauthorised Account access, money laundering and abuse of promotional offers.
• Responsible gambling: Monitoring gaming patterns to identify potentially problematic behaviour; giving effect to self-exclusion, deposit limit and cooling-off requests; proactively contacting users where welfare concerns are identified.
• Platform improvement: Analysing usage data to improve the Platform's performance, content and user experience — including optimising the mobile experience used by the majority of Pakistani users.
• Communications: Sending transactional emails (e.g., deposit confirmations, withdrawal notifications, KYC requests) and, where consent is given, marketing communications about offers and promotions.

kp66 shares personal data only where necessary, with parties who are contractually and legally obligated to handle it securely and in accordance with this Policy. Categories of recipients include:

• Payment processors: To facilitate deposits and withdrawals. This may include third-party payment service providers operating payment infrastructure. Where users transact via references to local providers such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah, data sharing is limited to what is necessary to complete the transaction, subject to each provider's own privacy terms. kp66 does not control how these providers use data beyond their stated transactional role.
• KYC and AML service providers: To verify identity documents, conduct sanctions screening and perform fraud checks as required by licence conditions.
• Technology and infrastructure providers: Hosting, cloud storage, content delivery, cybersecurity and analytics services that process data on our behalf under strict data processing agreements.
• Game content providers: Third-party game studios whose titles appear on the Platform may receive session and betting data necessary to operate their games and audit outcomes.
• Regulatory and law enforcement bodies: Where required by applicable law, court order or regulatory authority, kp66 will disclose personal data as directed. This includes anti-money laundering reporting obligations.
• Business successors: In the event of a merger, acquisition or sale of assets, personal data may be transferred to the acquiring entity, subject to the same protections described in this Policy.

kp66 operates internationally and may transfer your personal data to countries outside your country of residence, including to countries that may not provide the same level of data protection as your home jurisdiction. Where such transfers occur, we take appropriate safeguards to ensure your data remains protected, including:

• Transferring only to countries that have been recognised as providing an adequate level of data protection by the relevant supervisory authority
• Using contractual safeguards (such as Standard Contractual Clauses) with processors located in countries without an adequacy determination
• Ensuring all international processors are subject to binding data processing agreements that mandate equivalent security standards

Users located in Pakistan should be aware that Pakistan does not currently have a comprehensive data protection law equivalent to the GDPR, though the Personal Data Protection Bill has been under development. kp66 applies GDPR-aligned standards as a baseline regardless of jurisdiction.

kp66 retains personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Our general retention standards are:

• Active Account data: Retained for the lifetime of your Account and for a period of at least 5 years after Account closure, to satisfy AML record-keeping requirements.
• Transaction records: Financial transaction records are retained for a minimum of 5 years from the date of the transaction in accordance with standard AML and gaming licence obligations.
• KYC documents: Identity verification documents are retained for the period required by applicable regulatory obligations, typically 5 years from Account closure.
• Support communications: Customer service correspondence is retained for up to 3 years to facilitate ongoing support and complaint management.
• Cookies and analytics data: Non-essential session data is retained for up to 13 months in aggregate analytics systems.
• Self-exclusion records: Self-exclusion and responsible gambling restriction records may be retained indefinitely to prevent re-registration during a mandatory exclusion period.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our internal data destruction procedures.

kp66 uses cookies and similar technologies (including pixel tags and local storage) to operate the Platform, remember your preferences and analyse usage. The categories of cookies we use are described below:

You can control cookie settings through your browser. Most browsers allow you to refuse new cookies, delete existing cookies and set preferences for specific sites. Disabling strictly necessary cookies may impair Platform functionality. For instructions on managing cookies in your browser, refer to your browser's help documentation.

Subject to applicable law and the conditions set out below, you have the following rights in relation to your personal data held by kp66. To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days of receiving your request, or notify you if additional time is required.

The kp66 Platform is strictly for adults aged 18 and over — or the higher minimum age required by the operator's licence jurisdiction. We do not knowingly collect personal data from persons under the age of 18. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated Account.

If you are a parent or guardian and believe that a person under 18 has provided personal data to kp66, please contact us immediately at [email protected].

kp66 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• TLS/SSL encryption for all data in transit between your device and the Platform
• Encryption of sensitive personal data at rest, including KYC documents and financial records
• Strict role-based access controls limiting internal staff access to personal data on a need-to-know basis
• Continuous monitoring and intrusion detection systems to identify and respond to security threats
• Regular security assessments and penetration testing by qualified third-party specialists
• Data breach response procedures, including notification to affected users and regulatory authorities within required timeframes

Whilst we take all reasonable precautions, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Users should also take responsibility for securing their own Account credentials and devices.

kp66 serves a significant proportion of English-speaking users based across Pakistan, including in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. We recognise that Pakistan does not currently have a fully enacted comprehensive data protection law. The Personal Data Protection Bill has been under legislative consideration in Pakistan; however, at the time of writing, no general data protection statute equivalent to the GDPR is in force in Pakistan.

kp66 voluntarily applies the data protection principles described in this Policy — including purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality — as a matter of good practice for all users regardless of jurisdiction.

Pakistani users should also be aware that certain data sharing with payment processors may involve references to locally familiar services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah. These references are made in the context of payment facilitation only. kp66 does not claim that these providers endorse or are affiliated with gambling activities, and users must review each provider's own privacy terms when conducting transactions through their services.

kp66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Platform functionality or our data processing practices. Where amendments are material, we will notify registered users via a prominent notice on the Platform, by email or via your Account notification centre, prior to the revised Policy taking effect.

The effective date at the top of this page indicates the version currently in force. We encourage you to review this Policy periodically. Continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the changes.

If you have any questions, concerns or requests regarding this Privacy Policy or the way kp66 handles your personal data, please reach out to us using the contact details below. Our team responds in English; Urdu-language assistance is available on request.