ko37 Privacy Policy

This Privacy Policy (hereinafter "the Policy" or "this Policy") describes the practices of ko37 (the "Platform", "we", "us", or "our") in relation to the collection, use, storage, disclosure, and protection of personal data belonging to registered users and visitors (each a "User", "you", or "your") of the ko37 online sports betting and casino platform, accessible at ko37.cam.

By accessing the Platform, creating an Account, or submitting personal data to ko37 in any form, you acknowledge that you have read and understood this Policy and that you consent to the data practices described herein, to the extent that consent is the applicable legal basis for the relevant processing activity.

This Policy should be read together with ko37's Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

In this Policy, the following terms have the meanings set out below:

For the purposes of this Policy, the Data Controller responsible for personal data collected through the ko37 Platform is the legal entity operating the ko37 brand at the domain ko37.cam. The Data Controller determines the purposes for which, and the manner in which, personal data is processed.

Where ko37 engages third-party service providers — including payment processors, KYC verification services, analytics providers, or game content suppliers — those parties act as Data Processors under contractual arrangements that require them to process personal data only in accordance with ko37's instructions and applicable data protection obligations.

For data-related enquiries, please contact ko37 using the details in Section 15 of this Policy.

ko37 collects personal data through multiple channels in the course of operating the Platform. The categories of data collected are set out below:

4.1 Registration Data. When you create an Account, we collect your full name, date of birth, email address, telephone number, residential address, and chosen account credentials. This data is necessary to establish and administer your Account.

4.2 Identity Verification (KYC) Data. In connection with the KYC process, we collect copies of government-issued identity documents (such as a valid CNIC or passport for Pakistani users), proof of address documentation, and biometric verification data (such as a selfie or liveness check) where required. This data is collected and processed in accordance with applicable AML and age-verification obligations.

4.3 Financial and Transaction Data. We collect records of all deposits, withdrawals, and wagers placed on the Platform. Where payments are made by bank transfer, digital wallet (such as through payment methods familiar to Pakistani users), or other means, we collect sufficient payment information to process and reconcile transactions. We do not store full payment card numbers on our systems.

4.4 Usage and Behavioural Data. We automatically collect data about how you interact with the Platform, including pages visited, games played, bets placed, session durations, and in-play activity. This data is used for account management, responsible gambling monitoring, fraud detection, and service improvement.

4.5 Technical Data. We collect technical information including your IP address, browser type and version, operating system, device identifiers, time zone settings, and referring URLs. This data is collected for security, fraud prevention, and analytics purposes.

4.6 Communications Data. If you contact ko37 support via live chat, email, or any other channel, we retain records of those communications, including the content of your message and any data you provide.

ko37 uses the personal data it collects for the following purposes:

ko37 processes personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions — including operating your Account, settling bets, and processing payments.
• Legal Obligation: Processing necessary to comply with applicable legal requirements, including AML obligations, age verification mandates, and regulatory record-keeping.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where such interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and non-essential analytics cookies, where you have given explicit, informed consent. You may withdraw consent at any time by contacting support or adjusting your account marketing preferences.

Where processing is based on consent, withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawal. Withdrawal of consent to certain processing (e.g., KYC-related identity processing) may prevent ko37 from continuing to operate your Account.

ko37 does not sell, rent, or trade your personal data. We may share personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment Processors: To facilitate deposits and withdrawals. The payment providers used by the Platform process transaction data in accordance with their own privacy policies and applicable financial regulation. Note: payment providers familiar to Pakistani users — such as digital wallet operators and bank transfer services — are referenced as convenience context only; their specific data-sharing arrangements are governed by their own terms.
• KYC and Identity Verification Providers: Third-party services engaged to perform identity, age, and document verification. These providers process identity documents only as necessary to complete the verification task.
• Game Content and Platform Technology Providers: Third-party suppliers of casino games, sports data feeds, and live dealer services who may receive limited account and session data necessary for game operation.
• Regulatory and Law Enforcement Authorities: Where required by applicable law or a lawful request from a competent authority. ko37 will disclose only the minimum personal data required to satisfy the specific legal obligation.
• Analytics and Fraud Prevention Services: Service providers that assist ko37 in analysing platform usage and detecting fraudulent activity. Data shared for these purposes is subject to contractual restrictions on further use.

Where data is transferred to service providers located outside the jurisdiction in which it was collected, ko37 implements contractual safeguards to ensure an adequate level of protection is maintained.

ko37 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored on your device when you visit a website. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session management cookies, authentication tokens, and security cookies. These cookies cannot be disabled without preventing core platform functionality. No consent is required for their placement.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred odds format, and responsible gambling limit configurations. These enhance your experience but are not essential to basic operation.
• Analytics Cookies: Used to collect aggregate, anonymised data about how visitors interact with the Platform, enabling ko37 to identify areas for improvement. These are only placed with your consent.
• Security and Fraud Prevention Cookies: Used to detect and prevent unauthorised access, bot activity, and other security threats. These operate as part of ko37's legitimate interest in platform security.

You can manage and delete cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. For mobile users accessing ko37 on Android or iOS devices in Pakistan, your browser's privacy settings apply in the same way as on desktop.

ko37 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account Data: Retained for the duration of your Account and for a minimum period following Account closure as required by applicable AML and record-keeping legislation, typically five (5) to seven (7) years.
• KYC and Identity Documents: Retained for the period required by the operator's regulatory obligations. Typically this mirrors the AML record-keeping period applicable to the Platform's license jurisdiction.
• Transaction Records: Retained for a minimum of five (5) years following the relevant transaction, in accordance with standard financial record-keeping requirements.
• Communications Data: Support communications are retained for a period sufficient to resolve any related disputes, typically two (2) years unless a longer period is required.
• Marketing Preferences: Records of consent and opt-out history are retained indefinitely to demonstrate compliance with applicable consent obligations.
• Technical and Usage Data: Aggregate and anonymised analytics data may be retained indefinitely as it no longer constitutes personal data once anonymisation is applied.

Following the expiry of applicable retention periods, personal data is securely deleted or rendered permanently irreversible through anonymisation.

Subject to applicable law and the limitations described below, you have the following rights in relation to your personal data held by ko37:

To exercise any of the above rights, please submit a written request to ko37 support via live chat or to the email address in Section 15. We will respond within a reasonable period — typically 30 days — and may require identity verification before processing your request. We will not charge a fee for reasonable access requests.

ko37 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encrypted storage of sensitive personal data, including KYC documents and financial records, on secure servers with restricted access controls.
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need.
• Two-factor authentication options for Account access, strongly recommended for all users.
• Regular security assessments and penetration testing of Platform infrastructure.
• Incident response procedures to detect, contain, and notify of data security incidents within applicable timeframes.

Notwithstanding these measures, no system is entirely immune from security risks. ko37 cannot guarantee absolute security and will not be liable for breaches that result from events beyond its reasonable control. You are responsible for maintaining the security of your own Account credentials. If you suspect your Account has been compromised, notify support immediately.

ko37 does not knowingly collect or process personal data from persons under the minimum eligible age (18 years, or the higher minimum required by the applicable jurisdiction or operator's license conditions). The Platform is strictly for adults.

Where ko37 discovers or is notified that personal data has been collected from a person below the minimum eligible age, we will take immediate steps to delete that data, close the relevant Account, and return any deposited funds in accordance with applicable policy. If you believe a minor has registered on the Platform, please contact support immediately.

The ko37 Platform may from time to time contain references to third-party services, payment providers, or external resources. These references are provided for informational purposes only. ko37 does not control the content or data practices of any third-party service, and this Policy does not apply to any personal data collected by such third parties.

You are encouraged to review the privacy policies of any third-party services you interact with in connection with your use of ko37, including payment providers. ko37 accepts no responsibility for the privacy or security practices of third parties.

ko37 reserves the right to update, amend, or replace this Privacy Policy at any time. Material changes — that is, changes affecting your rights or our data collection practices in a substantive way — will be communicated to registered users via in-platform notification or email at least fourteen (14) days prior to the effective date, wherever practicable.

The "Effective Date" displayed at the top of this Policy indicates when the current version came into force. Your continued use of the Platform following the effective date of any revision constitutes your acknowledgement of the updated Policy. If you do not agree to a revised Policy, you should discontinue use of the Platform and contact support to close your Account.

We encourage you to review this Policy periodically to stay informed about how ko37 handles your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way ko37 processes your personal data, please contact our support team. We are committed to addressing all data-related enquiries promptly and thoroughly.

Support is available 24 hours a day, 7 days a week via live chat within the Platform. For written data protection enquiries — including subject access requests, rectification requests, and erasure requests — please use the support email address set out below. Please mark your message clearly as a "Data Protection Request" to ensure it is directed to the appropriate team.

We aim to acknowledge all data protection requests within 3 business days and to provide a full response within 30 days. Where a request is complex or requires identity verification, we may notify you of a reasonable extension in accordance with applicable data protection standards.