Privacy Policy

Article 1Identity of the data controller

The data controller for the data collected on the Platform is:

For any questions regarding the protection of your data, you can contact our DPO at the address above.

Article 2Data we collect

2.1 Data provided directly by the User

When you create an Account and use the Platform, Ktkarena collects the following data:

• email address;
• password (stored in hashed form, never in plain text);
• username;
• date of birth;
• country of residence;
• phone number (optional);
• profile photo (optional);
• public bio (optional);
• official ID document (only if KYC is required);
• proof of address (only if KYC is required);
• bank or Mobile Money details (only for withdrawals).

2.2 Data generated through use

Ktkarena automatically collects the following data:

• betting history and bet resolutions;
• deposit and withdrawal history;
• KTK balance and transaction history;
• social interactions (messages, leagues, challenges);
• predictions and Devin score;
• in-app actions (clicks, navigation, session duration);
• user preferences (language, currency, theme).

2.3 Technical data

Ktkarena also collects:

• IP address;
• device fingerprint (deviceFingerprint) for anti-fraud purposes;
• operating system and version;
• device model;
• internet service provider;
• approximate geolocation (country, region) derived from the IP address.

Article 3Purposes and legal bases

Your personal data is processed for the following purposes, each founded on a legal basis within the meaning of the GDPR:

3.1 Performance of the contract (Article 6.1.b GDPR)

• creation and management of the Account;
• execution of bets and payments;
• communications relating to your Account;
• user support.

3.2 Legal obligations (Article 6.1.c GDPR)

• identity verification (KYC) for withdrawals above legal thresholds;
• anti-money laundering and counter-terrorism financing;
• retention of financial transactions in accordance with accounting obligations.

3.3 Legitimate interest (Article 6.1.f GDPR)

• fraud prevention and Platform security;
• product improvement (anonymized analytics);
• relevant marketing communications (with the option to object).

3.4 Consent (Article 6.1.a GDPR)

• sending the newsletter;
• non-essential cookies;
• sharing public opinions on the social feed.

3.5 Protection of vital interests (Article 6.1.d GDPR)

• reports relating to gambling addiction prevention.

Article 4Data recipients

Your personal data may be disclosed to the following recipients:

4.1 Ktkarena internal staff

Administrators who need to access data as part of their duties (support, moderation, security, accounting). All access to personal data is logged (PII Access Log).

4.2 Technical service providers

4.3 Payment providers

4.4 Competent authorities

In the event of a valid legal request (court order, tax obligation, anti-money laundering).

Article 5Transfers outside the EU

Some of your data may be transferred outside the European Union, in particular to our hosting and payment providers.

These transfers are governed by:

• the standard contractual clauses adopted by the European Commission;
• adequacy decisions where they exist;
• additional safeguards (encryption at rest and in transit, restricted access, audits).

The full list of providers and their locations is available on request at privacy@ktkarena.com.

Article 6Retention periods

Data relating to self-exclusion measures is kept permanently in order to guarantee the effectiveness of the measure, even in the event of an attempted re-registration.

Article 7Data security

Ktkarena implements appropriate technical and organizational measures to protect your data:

7.1 Encryption

• AES-256-GCM encryption of sensitive personal data at rest (email, phone, etc.);
• TLS 1.3 minimum encryption for all network communications;
• httpOnly, Secure, SameSite=Strict cookies for sessions.

7.2 Authentication

• Passwords hashed with bcrypt (never stored in plain text);
• Two-factor authentication (2FA) available and recommended;
• Automatic lockout after failed login attempts.

7.3 Integrity

• Immutable audit log of all sensitive changes (Audit Log Tier System);
• PostgreSQL triggers preventing unauthorized changes to balances and roles;
• Automatic anomaly detection (Fraud Detection).

7.4 Confidentiality

• Restricted data access based on the principle of least privilege;
• Every access to personal data by an administrator is logged (PII Access Log);
• Regular data protection training for our teams.

Article 8Your rights (GDPR)

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

8.1 Right of access

You can obtain a copy of all data concerning you. Requests are made from your Account settings or by email to privacy@ktkarena.com. Response within 30 days.

8.2 Right to rectification

You can correct any inaccurate data directly from your Account settings or by written request.

8.3 Right to erasure (“right to be forgotten”)

You can request the complete deletion of your data. Deletion takes effect within 30 days, subject to legal retention obligations (Article 6).

8.4 Right to data portability

You can obtain a copy of your data in a structured, commonly used and machine-readable format (JSON), in order to transmit it to another service.

8.5 Right to object

You can object to the processing of your data based on our legitimate interest, in particular for marketing communications.

8.6 Right to restriction of processing

In certain cases, you can request the restriction of the processing of your data.

8.7 Right to withdraw consent

You can withdraw your consent at any time, where consent is the legal basis for the processing.

8.8 How to exercise your rights

All requests can be sent to privacy@ktkarena.com with proof of your identity. A response will be provided within 30 days, extendable by 60 days in cases of particular complexity.

Article 9Cookies and trackers

The use of cookies is detailed in our Cookie Policy, available at legal-cookies.html.

Article 10Minors

The Platform is strictly reserved for adults. Ktkarena does not knowingly collect any data concerning minors. If you believe a minor has created an Account, please report it to us immediately at privacy@ktkarena.com so that we can delete the Account and the associated data.

Article 11Changes

This Privacy Policy may be amended. Any substantial change will be notified by email and in the app at least 30 days before it takes effect.

Article 12Complaints

If you believe your rights are not being respected, you can:

• contact our DPO at privacy@ktkarena.com;
• lodge a complaint with Cameroon's National Data Protection Authority;
• lodge a complaint with the competent supervisory authority of your country of residence (for example, the CNIL in France).