CRYSTAL SPORT

1. Who We Are

Crystal Sport Limited ('Crystal Sport', 'we', 'us', or 'our') operates the Crystal Sport betting platform at crystalsport.ng. We are the Data Controller responsible for your personal data.

2. Data We Collect

3. How We Use Your Data

4. Data Sharing

We do not sell your personal data. We share your data only in the following circumstances:

5. Data Retention

We retain your personal data for the following periods:

• Account data: For the duration of your account plus 7 years after closure (required by Nigerian gambling regulations).
• Transaction records: 7 years from the date of transaction (AML/CTF requirement).
• KYC documents: 5 years from the date of verification or account closure.
• Session and IP logs: 2 years from the date of collection.
• Support communications: 3 years from the date of the last communication.
• Marketing consent records: Until consent is withdrawn plus 2 years.

When data is no longer required, it is securely deleted or anonymised.

6. Your Rights Under the NDPR

Under the Nigeria Data Protection Regulation, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data in certain circumstances.
• Right to restriction: Request restriction of processing in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for marketing at any time.

To exercise any of these rights, contact our Data Protection Officer at dpo@crystalsport.ng. We will respond within 30 days. Please note that some rights may be limited by our legal obligations as a licensed gambling operator.

7. Cookies

8. Data Security

Crystal Sport implements robust technical and organisational measures to protect your data:

• All data is encrypted in transit using TLS 1.3.
• Passwords are hashed using industry-standard algorithms and never stored in plain text.
• BVN and NIN data is encrypted at rest and never stored in full.
• Access to production systems is restricted to authorised personnel only.
• Regular security audits and penetration testing are conducted.
• All staff handling personal data receive data protection training.
• We maintain an incident response plan for data breaches.

In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities within 72 hours of becoming aware of the breach, as required by the NDPR.

9. Responsible Gambling and Data

Crystal Sport collects and processes data related to your betting behaviour to fulfil our responsible gambling obligations under NLRC licensing conditions. This includes:

• Monitoring betting patterns for signs of problem gambling.
• Enforcing self-imposed deposit limits and exclusions.
• Sharing data with responsible gambling organisations where required.
• Reporting to NLRC on responsible gambling compliance metrics.

This processing is carried out under our legal obligation as an NLRC licensed operator and cannot be opted out of.

10. Children's Privacy

Crystal Sport is strictly for persons aged 18 and over. We do not knowingly collect data from anyone under 18. If we discover that we have inadvertently collected data from a minor, we will immediately delete that data and close the account. If you believe we have collected data from a minor, please contact us immediately at safeguarding@crystalsport.ng.

11. International Data Transfers

Your data is primarily processed and stored in Nigeria. Where we use service providers located outside Nigeria (such as cloud infrastructure providers), we ensure appropriate safeguards are in place in accordance with the NDPR, including standard contractual clauses and data processing agreements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 7 days before changes take effect. The current version will always be available at crystalsport.ng/privacy.

13. Contact and Complaints

For any privacy-related queries or to exercise your rights, contact:

If you are not satisfied with our response, you have the right to complain to: