Privacy Policy
Data Controller: Crystal Sport Ltd (RC 9409331), www.crystalsport.ng Data protection contact: privacy@crystalsport.ng Last updated: 16 August 2026
1. Introduction
This Privacy Policy explains how Crystal Sport Ltd ("Crystal Sport", "we") collects, uses, shares, and protects your personal data when you use our Platform. We process personal data in accordance with the Nigeria Data Protection Act 2023 and applicable regulations.
By using the Platform you acknowledge this Policy. Where we rely on your consent (for example, certain marketing or identity checks), we will ask for it separately and you may withdraw it.
2. The data we collect
You give us:
- Identity data: full name, date of birth, gender, address, nationality.
- Contact data: email, phone number.
- Verification (KYC) data: BVN, NIN, government ID details and images, selfie/liveness image, proof of address.
- Financial data: payment method details, bank account for withdrawals, transaction history.
- Account data: username, password (stored hashed), preferences.
We collect automatically:
- Betting activity: bets placed, stakes, outcomes, balances.
- Technical data: IP address, device and browser information, approximate location, session and log data.
- Cookies and similar technologies (see section 9).
We receive from others:
- Identity verification results from our licensed KYC provider, Dojah.
- Payment confirmations from our payment partner, Flutterwave.
- Data from fraud-prevention and AML screening sources where applicable.
We generally do not seek special-category data. Biometric data (your selfie/liveness image) is processed only for identity verification and fraud prevention.
3. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and manage your account | Performance of our contract with you |
| Verify your identity and age (KYC) | Legal obligation; performance of contract |
| Process deposits, bets, and withdrawals | Performance of contract |
| Prevent fraud, money laundering, and underage gambling | Legal obligation; legitimate interest |
| Comply with our licence, AML, and regulatory duties | Legal obligation |
| Provide support and respond to complaints | Performance of contract; legitimate interest |
| Responsible-gambling monitoring and interventions | Legal obligation; legitimate interest; vital interests |
| Improve and secure the Platform | Legitimate interest |
| Marketing (where you have not opted out / have opted in as required) | Consent and/or legitimate interest |
4. Age and responsible gambling
We process data specifically to confirm you are 18 or older and to operate responsible-gambling tools (limits, time-outs, self-exclusion). We may use activity data to identify signs of harm and take protective action, including contacting you or restricting your account.
5. Who we share data with
- KYC / identity provider (Dojah) — to verify identity and age.
- Payment provider (Flutterwave) — to process deposits and withdrawals.
- Regulators and authorities — where required by law, our licence, or AML obligations (including SCUML/NFIU reporting where applicable).
- Service providers — hosting, communications (SMS/email), analytics, and security vendors acting on our instructions under data-processing agreements.
- Professional advisers — legal, audit, where necessary.
- Successors — in a merger or acquisition, subject to this Policy.
We do not sell your personal data.
6. International transfers
Some providers may process data outside Nigeria. Where they do, we ensure an adequate level of protection through appropriate contractual safeguards consistent with the Nigeria Data Protection Act.
7. How long we keep data
We keep personal data for as long as your account is active and thereafter for the period required by law and our regulator — in particular, betting, transaction, KYC, and AML records are retained for the period required by applicable anti-money-laundering law after account closure. After that, data is deleted or anonymised.
8. Your rights
Subject to law, you may:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion (subject to our legal and regulatory retention duties — note we cannot delete records we are required to keep);
- Object to or restrict certain processing;
- Withdraw consent where processing is based on consent;
- Request portability of certain data;
- Opt out of marketing at any time.
To exercise these rights, email privacy@crystalsport.ng. We will respond within the timeframe required by law. You also have the right to lodge a complaint with the Nigeria Data Protection Commission.
9. Cookies
We use cookies and similar technologies to keep you logged in, remember preferences, secure the Platform, and understand usage. You can control cookies through your browser and our cookie banner.
10. Marketing
If we send marketing, we will do so in line with your preferences and applicable law. Every marketing message includes an opt-out, and you can manage preferences in your account settings. If you self-exclude, we will stop gambling-related marketing to you.
11. Security
We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and audit logging. We restrict identity documents to verification and fraud-prevention purposes and do not retain raw identity images longer than necessary. No system is perfectly secure; we will notify you and the regulator of a data breach where required by law.
12. Children
The Platform is strictly for adults aged 18+. We do not knowingly collect data from anyone under 18. If we learn we have, we will delete it and close any associated account.
13. Changes
We may update this Policy. Material changes will be notified by email and/or on-site. The "last updated" date shows the current version.
14. Contact
Crystal Sport Ltd (RC 9409331), No. 37 Ore-Ofe Street, Okokomaiko, Lagos, Lagos State, Nigeria. For data-protection matters, email privacy@crystalsport.ng.