Privacy Policy
This Policy explains how KANGOTECH LTD collects and uses personal data when you use KOT.GG, and the privacy rights available to you.
Effective date: August 27, 2026
1. Controller and contact
KANGOTECH LTD is the controller of the personal data described in this Policy. We are registered in England and Wales under company number 17037148 at 128 City Road, London, United Kingdom, EC1V 2NX. Privacy questions and rights requests may be sent to [email protected]. Please do not email passwords, full payment card details, identity documents or game account credentials unless we give you a secure method and specifically ask for them.
2. Data we collect
Depending on how you use KOT.GG, we collect account and contact data; sign-in provider identifiers; preferences; order, product, price, payment-status and refund data; invoices; support messages; K’ Points and referral activity; IP address, device, browser, session, security and fraud signals; page and checkout journey events; reviews; and the account, character, server, region or other details you submit for delivery. Payment providers process full card or wallet credentials; we normally receive tokens, limited payment details and transaction status rather than full card numbers.
3. Sources of data
We receive data directly from you and your use of the site, and from sign-in, payment, identity-verification, email, hosting, anti-fraud and fulfilment providers. We may also receive chargeback, sanctions, risk or transaction information from financial institutions and lawful public sources. If you provide another person’s data, you must be authorized to do so and tell them about this Policy where appropriate.
4. Purposes and legal bases
We process data as necessary to perform or prepare a contract: creating accounts, processing payment, delivering products, managing orders, providing support, refunds and loyalty benefits. We process data to comply with legal obligations such as tax, accounting, sanctions, fraud enquiries and valid authority requests. We rely on legitimate interests to secure the service, prevent abuse, keep audit records, improve reliability, defend claims and understand first-party service performance, after balancing those interests against your rights. Where consent is required, including for certain storage technologies or communications, you may withdraw it at any time without affecting earlier lawful processing.
5. Identity verification and sensitive data
Risk-based checks may ask you to complete identity verification through Didit or another disclosed provider. The provider may process an identity document, image, video, facial comparison, date of birth, nationality and verification result. KOT.GG receives the result and a limited encrypted summary needed for review and audit; we do not intend to store provider document images or face scans in our application. Where biometric data is used to uniquely identify you, it receives special protection and is processed only where an applicable UK GDPR Article 9 and Data Protection Act 2018 condition is met. You may contact support to challenge a result or request human review where available.
6. Recipients and service providers
We disclose only data reasonably needed to payment providers such as Stripe; identity-verification providers such as Didit; authentication providers you choose; hosting, database, security, email, analytics, tax and customer-support providers; digital-product suppliers and fulfilment partners; professional advisers, insurers, auditors and potential business successors; and courts, regulators, law enforcement or other authorities where disclosure is lawful. Providers acting for us are contractually restricted to appropriate purposes. Some recipients, such as payment providers, may also act as independent controllers under their own notices.
7. International transfers
KOT.GG serves customers and uses providers in more than one country, so data may be processed outside the United Kingdom or your country. Where UK data-protection law requires a transfer safeguard, we use an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or another lawful safeguard, and apply supplementary protections where appropriate. Contact support for information about the safeguard relevant to your data.
8. Retention
We keep personal data only as long as needed for the purposes above. Account and active-order data is kept while the account or order requires it. Order, payment, refund, invoice and core accounting records are generally retained for up to six years after the relevant transaction or financial period to meet tax, accounting and legal-claim needs. Security, journey and fraud records are kept for a shorter risk-based period unless linked to an investigation or claim. Delivery secrets and sensitive buyer inputs are restricted and removed or minimized when no longer operationally required. Identity-verification data follows legal, risk and provider retention requirements. We may retain a minimal suppression or audit record after deletion where necessary.
9. Security
We use measures appropriate to the risk, including access controls, phishing-resistant protection for administrative access, encryption for selected sensitive data, credential separation, logging, monitoring, backups and tested operational procedures. No internet service is completely secure. You should use a secure email account and passkey where offered, protect delivered codes and notify support promptly of suspected compromise.
10. Your rights
Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent. You may also object to direct marketing at any time. Send a request to [email protected]. We may ask for proportionate proof of identity and may retain or withhold data where the law permits or requires it. We normally respond within the period set by applicable law and will explain any lawful refusal.
11. Fraud decisions and human review
We use rules and risk signals to prioritize review, delay delivery, require verification or block suspicious transactions. Signals may include payment results, IP and device data, order pattern, account history and verification status. A rule may have a significant practical effect, but we do not intend to make a solely automated decision producing a legal or similarly significant effect unless permitted by law with required safeguards. Contact support if you believe a decision is wrong and want relevant information, to provide context or to request human review.
12. Cookies and storage technologies
We use cookies, local or session storage and similar technologies for essential functions such as authentication, security, fraud prevention, cart and checkout continuity, preferences and first-party service measurement. Where a technology is not strictly necessary or otherwise exempt, we provide required information and obtain consent or offer an applicable opt-out before using it. Browser controls can remove stored data, but blocking essential storage may stop parts of KOT.GG from working.
13. Children
KOT.GG is intended for adults able to contract. A person under 18 should not place an order or submit identity-verification data; a parent or legal guardian should transact instead. If you believe a child has provided personal data without appropriate authorization, contact support so we can investigate and take appropriate action.
14. Complaints and changes
Please contact [email protected] first so we can address a privacy concern. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk, or to the competent authority where you live where applicable. We may update this Policy as our services, providers or legal duties change. The effective date appears above, and we will provide additional notice of material changes where required.