Privacy Policy — k2345

k2345 ("we", "us", "our", "the Platform") operates the online gaming website accessible at k2345.pro. We are committed to protecting the privacy of every Member and visitor. This Privacy Policy describes in detail how we collect, use, store, share, and protect personal data in connection with the k2345 platform and all related services.

We take our responsibilities as a data controller seriously. The data practices described in this policy reflect the standards applied to our entire international player base, including the substantial proportion of our Members who are resident in Indonesia. Where Indonesian data protection considerations are relevant, we reference them specifically throughout this document.

This Privacy Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which form part of the contractual relationship between k2345 and each Member. If you have any questions about how your data is handled, please refer to the Contact section at the end of this document.

k2345 collects personal data that is strictly necessary to provide the gaming service, comply with licensing obligations, process financial transactions, and maintain platform security. The categories of data we collect are set out below.

We do not collect sensitive categories of personal data — such as racial or ethnic origin, political opinions, religious beliefs, or health information — unless you voluntarily disclose such information in the context of a responsible gaming support interaction, in which case it is handled with the highest level of confidentiality and used solely to provide appropriate assistance.

k2345 collects personal data through the following channels:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and behavioural data collected automatically as you browse and interact with the k2345 platform, via server logs, session tracking, and first-party cookies. See Section 9 for full details on our cookie practices.
• Third-party sources: Identity verification data returned by licensed KYC service providers; fraud-risk signals from payment processors and financial crime monitoring services; geolocation data derived from your IP address to enforce eligibility restrictions.
• Publicly available sources: In limited circumstances related to fraud investigation, we may review publicly available information to verify the accuracy of data provided to us.

We do not purchase marketing lists, scrape social media profiles, or obtain personal data from data brokers for any purpose.

We process your personal data only for specific, legitimate purposes. The table below maps each processing purpose to the data categories it involves.

We will not use your personal data for any purpose incompatible with those listed above without first obtaining your explicit consent or establishing a new lawful basis for processing.

k2345 processes personal data on one or more of the following lawful bases, in accordance with applicable international data protection standards:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with anti-money-laundering (AML) regulations, KYC obligations, and licensing requirements imposed by our international gaming licence.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services — provided such interests are not overridden by your fundamental rights.
• Consent: Processing for optional purposes such as promotional email communications, where we will obtain your affirmative consent and provide a simple mechanism for withdrawal at any time.

Where we rely on legitimate interests as the legal basis, we carry out a balancing test to confirm that our interests do not override yours. You may request details of any such balancing test by contacting us at the address in Section 14.

k2345 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. We share data only with the categories of recipients listed below, and only to the extent strictly necessary for each stated purpose.

• Payment processors and banks: Financial institutions including BCA, BRI, BNI, Mandiri, CIMB Niaga, and licensed e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction data required to process your deposits and withdrawals.
• KYC and identity verification providers: Licensed third-party verification services receive identity document images and personal details solely to confirm your identity against official records before withdrawals are approved.
• Fraud prevention and AML screening services: Specialist providers receive transactional and technical data to screen for patterns consistent with money laundering, fraud, or multi-accounting. All such providers are bound by strict data-processing agreements.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe may receive anonymised session-level data necessary to render games and calculate outcomes. These providers do not receive your name, banking details, or contact information.
• Customer support platforms: Secure, encrypted support tooling used to manage live chat and email interactions between you and the k2345 support team.
• Regulatory and law enforcement authorities: Where we are required by a valid legal order, court order, or regulatory obligation to disclose personal data, we will comply with that obligation and, where permitted by law, notify you.

As an internationally operated platform, k2345 may transfer your personal data to servers or processors located outside of Indonesia. Where such transfers occur, we apply appropriate safeguards to ensure that your data receives a level of protection equivalent to that afforded within Indonesia.

Safeguards applied to international transfers include: standard contractual clauses incorporated into data-processing agreements with all overseas processors; technical measures such as end-to-end encryption of data in transit; and restricting access to transferred data to personnel who have a documented need to process it for the purposes described in this policy.

By registering an Account with k2345 and submitting your personal data, you acknowledge that your data may be processed in jurisdictions outside Indonesia, subject to the safeguards described above.

k2345 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The general retention periods we apply are as follows:

• Active Account data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of verification, in accordance with anti-money-laundering legislation applicable to our licensing jurisdiction.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the interaction, or longer if the communication relates to an ongoing dispute or regulatory matter.
• Technical and behavioural data: Aggregated analytics data is retained indefinitely in anonymised form. Raw technical logs are retained for up to 12 months and then deleted or anonymised.
• Marketing consent records: Retained for the duration of the consent plus three (3) years following withdrawal of consent, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or rendered permanently anonymous in accordance with our internal data lifecycle management procedures.

k2345 uses a limited set of first-party cookies and similar technologies to operate and secure the platform. We do not deploy third-party advertising cookies, cross-site tracking pixels, or behavioural profiling tools that share your data with advertising networks.

You may disable non-essential cookies through your browser settings at any time. Please note that disabling session or security cookies will prevent you from logging into your Account and using core platform features. Disabling preference or analytics cookies will not affect your ability to play but may result in a less personalised experience.

k2345 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational measures include:

• TLS/SSL encryption: All data transmitted between your browser or app and the k2345 servers is encrypted using Transport Layer Security (TLS 1.2 or higher), indicated by the HTTPS protocol in your browser's address bar.
• Encryption at rest: Sensitive personal data — including KYC document files, financial account numbers, and hashed passwords — is encrypted at rest using AES-256 or equivalent industry-standard symmetric encryption.
• Access controls: Access to production systems and Member personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data complete mandatory data protection training and are bound by confidentiality obligations.
• Two-factor authentication (2FA): Members are strongly encouraged to enable 2FA on their Accounts. All administrative access to internal k2345 systems requires 2FA as a mandatory control.
• Real-time fraud monitoring: Automated systems monitor transaction patterns and login behaviour around the clock to detect and respond to suspicious activity, including potential account takeover attempts.
• Vulnerability management: The platform undergoes regular security assessments and penetration testing by qualified independent security professionals. Identified vulnerabilities are tracked and remediated according to a risk-prioritised schedule.

Despite these measures, no online system can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights, k2345 will notify affected Members and, where required, the relevant regulatory authority, within the timeframe mandated by applicable law.

As a Member of k2345, you hold the following rights in relation to your personal data. You may exercise any of these rights by contacting us at the details provided in Section 14. We will respond to verified requests within 30 days and will not charge a fee for reasonable requests.

Please note that some rights are subject to exceptions under applicable law. For example, we may be unable to erase data that we are legally required to retain for AML or licensing compliance purposes. Where we are unable to fulfil a request in full, we will explain the reason clearly and advise you of any available alternatives.

Parents and guardians who suspect that a minor has accessed or registered on the k2345 platform are encouraged to contact us immediately at the address in Section 14. We treat such reports as high-priority and will investigate and act on them within 24 hours of receipt.

k2345 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes — such as introducing a new category of data processing or sharing data with a new category of third party — we will notify you by email to the address registered on your Account at least 14 days before the change takes effect.

Minor changes, such as clarifications of existing language or corrections of typographical errors, may be made without advance notice. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically to stay informed about how k2345 protects your data. Continued use of the platform following the effective date of any update constitutes acceptance of the revised Privacy Policy.

To exercise any of your data rights, to raise a privacy concern, or to ask questions about this Privacy Policy, please contact the k2345 Data Protection team using the details below. All privacy-related requests are logged, tracked, and responded to within 30 days of receipt.

If you are not satisfied with our response to a privacy request or concern, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.