kp33 Privacy Policy
— Your Data, Your Rights

This Privacy Policy is issued by kp33 (referred to throughout as "kp33", "we", "us", or "our"), the operator of the online betting and casino platform accessible at kp33.biz. This Policy explains how kp33 collects, uses, stores, discloses, and protects personal information relating to registered account holders, prospective users, and visitors to the kp33 website (collectively referred to as "you" or "the User").

This Policy should be read in conjunction with kp33's Terms & Conditions and Responsible Gaming Policy, both of which are available on the kp33 platform. In the event of any conflict between this Privacy Policy and the Terms & Conditions regarding data processing matters, this Privacy Policy shall prevail.

By registering an account on kp33.biz, completing the KYC verification process, or otherwise using any service provided by kp33, you confirm that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein, to the extent that such processing is based on consent. Where processing is based on other lawful grounds (such as contractual necessity or legal obligation), consent is not required but this Policy still applies.

kp33 takes its obligations as a data controller seriously. Our approach to data protection is guided by internationally recognised privacy principles including purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. We collect only the data we genuinely need to deliver our Services and meet our compliance obligations.

kp33 collects and processes the following categories of personal data from users of the kp33 platform:

2.1 Identity & Registration Data

• Full legal name as it appears on official identification;
• Date of birth (required to verify the 21+ age eligibility requirement);
• Pakistani Computerised National Identity Card (CNIC) number and copies of the CNIC document;
• Username selected during account registration;
• Nationality and country of residence.

2.2 Contact Data

• Email address (used for account communications, KYC notifications, and, where consented, marketing);
• Pakistani mobile telephone number (used for account verification, two-factor authentication, and security alerts);
• Residential address (collected during KYC verification).

2.3 Financial & Payment Data

• JazzCash account number or registered mobile number;
• EasyPaisa account number or registered mobile number;
• Bank account details (account number, IBAN) for HBL, UBL, or Meezan Bank transactions;
• USDT wallet address where applicable;
• Transaction history including deposit amounts, dates, withdrawal requests, and processed amounts;
• Account balance history.

2.4 Transactional & Betting Data

• Complete betting and gaming history including stakes placed, markets selected, odds accepted, and outcomes;
• Casino game sessions including games played, bet sizes, session duration, and outcomes;
• Bonus usage and wagering requirement completion records;
• Win/loss records and account balance movements.

2.5 Technical & Device Data

• IP address and general geolocation data derived therefrom;
• Device type, operating system, browser type and version;
• Session duration, pages visited, and click-path data within the kp33 platform;
• Login timestamps and session records;
• Cookie identifiers and similar tracking technologies (see Section 7).

2.6 Communications Data

• Records of customer support interactions including live chat transcripts and email correspondence;
• Complaint records and resolution outcomes;
• Survey responses or feedback submitted voluntarily.

kp33 collects personal data through the following means:

• Direct Provision: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion;
• Automated Collection: Data collected automatically when you access kp33.biz, including technical and device data collected via cookies, server logs, and similar technologies;
• Third-Party Sources: Data received from identity verification service providers during KYC processing, payment processors during transaction processing, and fraud detection partners where applicable;
• Public Sources: In certain limited circumstances, data from publicly available sources where relevant to fraud prevention or compliance obligations.

kp33 processes your personal data only where a valid lawful basis exists. The following table sets out the primary lawful bases on which kp33 relies for each category of processing activity:

kp33 uses the personal data we collect for the following specific purposes:

• Providing and managing your kp33 account — creating your account, maintaining your balance, processing your bets, and enabling access to all platform features;
• Verifying your identity and age — confirming you meet the 21+ age requirement and that your identity matches the information provided during registration, as required by our licensing obligations;
• Processing payments — facilitating deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT, and processing withdrawal requests to your verified payment methods;
• Preventing and detecting fraud — monitoring account activity for signs of fraud, unauthorised access, identity theft, money laundering, or other prohibited conduct as set out in kp33's Terms & Conditions;
• Responsible gaming monitoring — tracking your betting and gaming patterns to identify potential problem gambling behaviours and to enable the operation of responsible gaming tools including deposit limits, loss limits, and self-exclusion;
• Customer support — responding to your queries, resolving disputes, and maintaining records of our communications with you;
• Regulatory compliance — meeting our obligations under kp33's international gaming licence, anti-money laundering requirements, and any applicable data protection regulations;
• Platform improvement — analysing anonymised and aggregated usage data to improve the kp33 platform's performance, user experience, and service quality;
• Marketing communications — where you have provided consent, sending you information about promotions, bonuses, new features, and relevant kp33 updates via email or SMS to your registered Pakistani mobile number.

kp33 does not use your personal data to make fully automated decisions that produce significant legal or similarly significant effects on you, without appropriate human review where such decisions are material to your account status or access to funds.

kp33 does not sell your personal data to third parties. We share your data only in the following circumstances and only to the extent necessary for the specific purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency processing services receive only the data necessary to process your specific transaction. These parties act as independent controllers for their own data processing and are subject to their own privacy policies and regulatory requirements;
• Identity Verification Providers: Third-party KYC service providers who assist kp33 in verifying the identity and age of account holders. These providers act as data processors under contract with kp33 and are bound by strict data processing agreements;
• Game Software Providers: Platform software partners including casino and slot game providers may receive limited technical data necessary to deliver game functionality and maintain game integrity. No financial or identity data beyond account session identifiers is shared with game providers;
• Fraud Prevention Services: Specialised fraud detection and anti-money laundering service providers who process data under contract with kp33 for the purpose of protecting the platform and its users;
• Regulatory Authorities: kp33's licensing authority and relevant regulatory bodies may require disclosure of certain account or transaction data as a condition of our gaming licence or under applicable anti-money laundering legislation. We comply with lawful requests for data disclosure from competent authorities;
• Legal Proceedings: In the event of legal proceedings involving kp33 or a User, relevant data may be disclosed to courts, arbitration panels, legal representatives, or other parties as required by legal process;
• Business Transfers: In the event of a merger, acquisition, or sale of kp33's business or assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations. You will be notified of any such transfer where required by law.

kp33 uses cookies and similar tracking technologies on the kp33.biz platform. Cookies are small data files placed on your device when you visit our website. They allow kp33 to provide a functional, personalised, and secure experience.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling essential cookies will impair your ability to use the kp33 platform effectively and may prevent you from logging in or accessing your account.

kp33 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active kp33 account is retained for the lifetime of the account plus a minimum period of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements;
• KYC Documentation: Identity verification documents (including CNIC copies) are retained for a minimum of five (5) years following account closure or the last transaction date, as required by applicable AML regulations;
• Transaction Records: Financial transaction records including deposit and withdrawal history are retained for a minimum of seven (7) years in compliance with financial record-keeping obligations;
• Betting History: Complete betting and gaming history records are retained for a minimum of five (5) years following the last transaction date;
• Customer Support Records: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction;
• Marketing Preferences: Records of your marketing consent or opt-out are retained for the lifetime of your account plus three (3) years.

Following the expiry of the applicable retention period, kp33 will securely delete or anonymise your personal data. Where data is anonymised rather than deleted, the anonymised data may be used for statistical and analytical purposes without restriction.

kp33 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your browser and kp33.biz is encrypted using 256-bit SSL/TLS encryption — the same standard used by major banking institutions;
• At-Rest Encryption: Sensitive personal data including identity documents and financial details are stored in encrypted form in kp33's database infrastructure;
• Access Controls: Strict role-based access controls limit which kp33 staff members can access personal data, based on the minimum necessary for their specific function. All staff access is logged and audited;
• Two-Factor Authentication: kp33 staff with access to user data systems are required to use multi-factor authentication. Users are encouraged to enable 2FA on their own kp33 accounts;
• Security Monitoring: kp33's infrastructure is monitored 24/7 for unauthorised access attempts, unusual data access patterns, and potential security incidents;
• Regular Security Reviews: kp33 conducts periodic security assessments of its data processing infrastructure and engages third-party security specialists to perform penetration testing.

kp33 operates as an international platform. Your personal data may be transferred to, stored in, or processed in countries other than Pakistan — including the country in which kp33 is licensed and countries where kp33's third-party service providers (including cloud infrastructure and game providers) are based.

Where personal data is transferred outside Pakistan, kp33 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which applies within kp33's licensing jurisdiction. These safeguards include contractual data protection clauses incorporated into agreements with all third-party recipients of personal data.

By using the kp33 platform and accepting this Privacy Policy, you consent to the transfer of your personal data internationally on the basis described above. kp33 will not transfer your data to jurisdictions that have been specifically identified as presenting unacceptable data protection risks without appropriate additional safeguards.

The kp33 platform is strictly for individuals aged 21 years and over. kp33 does not knowingly collect or process personal data from any person under the age of 21. The kp33 registration process includes mandatory age verification, and accounts found to belong to individuals under 21 will be suspended immediately with data handled in accordance with applicable child protection obligations.

If you believe that kp33 has inadvertently collected personal data from a person under the age of 21, please contact kp33 support immediately via live chat. kp33 will take immediate steps to verify the matter and, where confirmed, to delete the relevant data and close the account without delay.

As a data subject, you hold the following rights with respect to your personal data held by kp33. You may exercise these rights by contacting kp33 support through your account's live chat or via the support email address. kp33 will respond to valid data rights requests within 30 days of receipt.

• Right of Access: You may request a copy of all personal data kp33 holds about you, along with information about how it is being used. kp33 will provide this in a structured, commonly used format.
• Right to Rectification: Where personal data kp33 holds about you is inaccurate or incomplete, you have the right to request correction. You may update certain data directly within your kp33 Account Settings.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request the deletion of your personal data. Please note that this right is subject to limitations where data must be retained for legal, regulatory, or contractual reasons (such as AML record-keeping obligations).
• Right to Restrict Processing: Where you contest the accuracy of data or object to its processing, you may request that kp33 restricts its use of that data while the matter is reviewed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you may request a copy of your personal data in a machine-readable format for transfer to another service.
• Right to Object: You have the right to object to the processing of your personal data where kp33 relies on legitimate interests as its lawful basis. kp33 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

kp33 may send you marketing communications by email or SMS to your registered Pakistani mobile number, but only where you have provided explicit prior consent during or after account registration. Marketing communications may include information about new promotions, PSL betting offers, casino bonuses, new slot releases, and other kp33 platform news.

You may withdraw your consent to marketing communications at any time by:

• Updating your marketing preferences in your kp33 Account Settings;
• Clicking the unsubscribe link included in any marketing email sent by kp33;
• Contacting kp33 customer support via live chat to request removal from marketing lists.

Withdrawal of marketing consent will take effect within 5 business days. Transactional and service communications (such as deposit confirmations, withdrawal notifications, account security alerts, and KYC status updates) are not marketing communications and will continue to be sent regardless of your marketing preferences, as they are necessary for the operation of your account.

kp33's responsible gaming programme requires the processing of certain personal and behavioural data to function effectively. This includes monitoring your betting patterns, deposit frequency, session length, and win/loss records to identify potential indicators of problem gambling. This processing is based on kp33's legal obligations under its gaming licence and our legitimate interest in player welfare.

Data processed for responsible gaming purposes may be used to:

• Trigger automated or manual responsible gaming interventions (such as reality check notifications);
• Enforce deposit limits, loss limits, or self-exclusion requests that you have configured in your account settings;
• Enable kp33 staff to proactively contact users who show indicators of potentially problematic gambling behaviour;
• Maintain records of self-exclusion to prevent re-registration during an active exclusion period.

Where a player has self-excluded from kp33, the data necessary to enforce that exclusion — including account identity and exclusion period — will be retained for the duration of the exclusion period and for a reasonable period thereafter, regardless of any separate data deletion request. This is a mandatory requirement of responsible gaming compliance and cannot be overridden by a general erasure request.

kp33 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws or regulations, our platform's features, or our licensing obligations. The most current version of this Privacy Policy will always be available on the kp33 platform at kp33.biz/privacy-policy.

Where we make material changes to this Policy that affect how we process your personal data, we will provide reasonable advance notice to active account holders via email to the registered address and/or a prominent notice on the kp33 platform. Minor or non-material updates (such as formatting corrections or clarifications that do not alter the substance of our data processing) may take effect immediately upon publication without separate notification.

Continued use of the kp33 platform following the effective date of any amendment to this Privacy Policy constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how your data is being managed.

If you have any questions about this Privacy Policy, how kp33 processes your personal data, or how to exercise your data rights, please contact the kp33 team through any of the following channels:

• Live Chat: Available 24/7 through your logged-in kp33 account — the fastest way to reach our support team for any data-related query;
• Email: [email protected] — for formal data rights requests, please include your registered account username and a description of your request.

If you are not satisfied with kp33's response to a privacy complaint or data rights request, you may escalate your complaint to the relevant data protection authority or supervisory body in the jurisdiction in which kp33 holds its gaming licence. Details of the applicable authority will be provided upon request.

kp33 takes all privacy complaints seriously and commits to acknowledging receipt of complaints within 5 business days and providing a substantive response within 30 calendar days of receipt, or within such shorter period as may be required by applicable law.