pkr98 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

This Privacy Policy is published by pkr98.biz ("pkr98," "we," "us," "our") and applies to all personal data collected, processed, stored, or transmitted in connection with your use of the pkr98 platform, including the website at pkr98.biz, all associated gaming and sports betting services, customer support channels, and marketing communications.

This policy applies to all registered players and visitors to the pkr98 platform, regardless of geographic location. It is written in English and the English version of this policy governs in the event of any translation inconsistency. References to "you" or "your" in this document refer to any individual whose personal data is processed by pkr98 in connection with the services described.

pkr98 acts as the data controller in respect of personal data collected through the platform. This means pkr98 determines the purposes for which personal data is processed and the manner in which it is processed, and is responsible for ensuring that processing is carried out lawfully and in accordance with this policy.

pkr98 is committed to handling personal data responsibly and transparently, consistent with the requirements of its international gaming license and applicable data protection principles. This policy is reviewed and updated on a regular basis to reflect changes in our data practices, applicable law, and regulatory guidance.

pkr98 collects personal data through several channels and in several categories depending on how you interact with the platform. The following describes the types of data collected:

2.1 Registration and Identity Data

When you create a pkr98 account, we collect:

• Full legal name as it appears on your national identity document;
• Date of birth (used to verify the 21+ age requirement);
• Email address (used as primary account identifier and communication channel);
• Mobile phone number registered in Pakistan (used for two-factor authentication and account recovery);
• Residential address;
• Username and encrypted password.

2.2 Identity Verification (KYC) Documents

For account verification, withdrawal processing, and anti-money laundering compliance, pkr98 may request:

• Copy of a government-issued photo identity document (CNIC for Pakistani players);
• Proof of residential address (utility bill or bank statement not older than 3 months);
• Proof of payment method ownership (screenshot of JazzCash or EasyPaisa account, or bank statement showing the account holder name);
• Source of funds documentation for large transaction volumes, where required under AML obligations.

2.3 Financial Transaction Data

• Deposit amounts, timestamps, and payment method identifiers;
• Withdrawal requests, amounts, processing status, and destination payment method identifiers;
• Transaction history and account balance records;
• Bonus claims, wagering activity, and promotional participation records.

2.4 Gaming and Betting Activity Data

• Game session logs including games played, bet amounts, win/loss outcomes, and session duration;
• Sports betting history including event selection, stake amounts, odds accepted, and settlement outcomes;
• Responsible gaming tool settings including deposit limits, session reminders, and self-exclusion status.

2.5 Technical and Device Data

• IP address at time of login and during active sessions;
• Device type, operating system, and browser information;
• Geolocation data derived from IP address (general location only — not GPS-level precision unless separately consented to);
• Session duration and platform navigation patterns;
• Cookie identifiers and similar tracking data (see Section 6).

2.6 Communications Data

• Customer support communications including live chat transcripts, email correspondence, and support ticket records;
• Complaint records and dispute correspondence;
• Survey responses and voluntary feedback submitted through the platform.

pkr98 processes personal data for the following purposes:

pkr98 does not process your personal data for purposes other than those listed above without first providing notice and, where required, obtaining your consent.

pkr98 relies on the following legal bases for processing personal data, consistent with internationally recognized data protection principles:

• Contractual Necessity: Processing that is necessary to perform the contract between pkr98 and the player — including account management, payment processing, game delivery, and customer support — is carried out on the basis of contractual necessity. Without this processing, pkr98 cannot provide the services described in the Terms and Conditions.
• Legal Obligation: Processing required to comply with mandatory legal obligations — including KYC identity verification, anti-money laundering screening, tax reporting, and licensing authority requirements — is carried out on the basis of legal obligation. pkr98 cannot waive these obligations at a player's request.
• Legitimate Interests: Processing necessary for pkr98's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and business analytics — is carried out where such interests are not overridden by the player's fundamental rights and freedoms. pkr98 conducts a balancing assessment before relying on this basis.
• Consent: Processing for marketing communications and certain non-essential cookies is carried out on the basis of your freely given, specific, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

pkr98 does not sell personal data to third parties. Personal data is shared with the following categories of recipients only where necessary to deliver pkr98's services or to comply with legal obligations:

• Payment Processors and Financial Service Providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa/Mastercard network processors, and cryptocurrency payment gateways receive transaction data necessary to process deposits and withdrawals. These providers are subject to their own regulatory frameworks and data protection obligations.
• Game Software Providers: Licensed third-party game studios including Pragmatic Play, Evolution Gaming, Play'n GO, NetEnt, Ezugi, and others receive anonymized or pseudonymized session data necessary to deliver their game content and resolve technical disputes. RNG certification data is processed by accredited independent testing laboratories.
• KYC and Identity Verification Services: Specialist third-party KYC providers process identity documents and verification data on pkr98's behalf under data processing agreements that require them to maintain appropriate security and confidentiality standards.
• Fraud Detection and AML Compliance Providers: Anti-fraud and anti-money laundering screening services receive transaction and behavioral data necessary to identify and prevent financial crime.
• Customer Support Technology Providers: Live chat platform providers and support ticket management systems process communications data on pkr98's behalf, subject to appropriate data processing agreements.
• Regulatory and Legal Authorities: pkr98 will disclose personal data to its licensing authority, law enforcement agencies, or other regulatory bodies where required to do so by applicable law, court order, or regulatory instruction. pkr98 will, where legally permissible, notify affected players of such disclosures.
• Professional Advisors: Legal counsel, auditors, and compliance consultants may access personal data on a strictly confidential, need-to-know basis in the course of providing professional services to pkr98.

All third-party service providers who process personal data on pkr98's behalf are required to enter into data processing agreements that bind them to confidentiality obligations, security standards, and restrictions on the use of data consistent with this Privacy Policy.

pkr98 uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device by the pkr98 website when you visit. Cookies are used for the following purposes:

• Essential Cookies: Required for the platform to function correctly — including maintaining your authenticated login session, remembering your cookie consent preference, and supporting security features such as CSRF protection. These cookies cannot be disabled without preventing core platform functionality.
• Performance and Analytics Cookies: Used to understand how players navigate the platform, which features are used most frequently, and where technical performance can be improved. Data collected through analytics cookies is aggregated and anonymized.
• Functionality Cookies: Used to remember your preferences — such as language settings, preferred game categories, and responsible gaming tool configurations — so you do not need to re-enter these settings on each visit.
• Marketing Cookies: Used only where you have provided consent to receive personalized marketing content. These cookies track your platform activity to enable relevant promotional communications. Marketing cookies can be disabled through your account communication preferences without affecting access to any core platform service.

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will affect platform functionality. pkr98 does not use cross-site tracking cookies to monitor your activity on websites other than pkr98.biz.

As an internationally licensed gaming platform, pkr98 may transfer personal data to service providers and technology infrastructure located in jurisdictions outside Pakistan. Where such transfers occur, pkr98 ensures that adequate safeguards are in place to protect your data to a standard consistent with internationally recognized data protection principles.

Safeguards used for international data transfers by pkr98 include:

• Contractual data transfer agreements with receiving parties that incorporate internationally recognized standard data protection clauses;
• Transfers only to jurisdictions that maintain data protection standards recognized as adequate by the platform's licensing authority;
• Technical security measures — including encryption in transit and at rest — that apply regardless of the geographic location of data processing.

pkr98 retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Active Account Data: Personal data associated with an active pkr98 account is retained for the lifetime of the account plus any mandatory post-closure retention period required by applicable law or the platform's licensing conditions.
• KYC and Transaction Records: Identity verification documents and financial transaction records are retained for a minimum of five years following account closure, consistent with standard anti-money laundering record-keeping requirements. This retention period may be extended where an account is subject to an ongoing investigation or legal proceeding.
• Customer Support Records: Support communications and complaint records are retained for three years from the date of the last interaction, to allow for complaint re-escalation and regulatory audit purposes.
• Marketing Data: Personal data used for marketing communications is retained until consent is withdrawn or until 12 months of account inactivity, whichever occurs first.
• Analytics Data: Aggregated and anonymized analytics data that cannot be re-associated with an individual is not subject to deletion schedules and may be retained indefinitely for platform improvement purposes.

When personal data is no longer required for any retained purpose, it is securely deleted or irreversibly anonymized in accordance with pkr98's data disposal procedures.

pkr98 implements a multi-layered technical and organizational security framework designed to protect personal data against unauthorized access, loss, alteration, or disclosure. Key security measures include:

• Encryption in Transit: All data transmitted between your device and pkr98 servers is protected by TLS 1.3 with 256-bit encryption. The pkr98 platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data — including identity documents, payment method details, and account credentials — is encrypted at rest using AES-256 encryption on secured database infrastructure.
• Access Controls: Access to personal data within pkr98's internal systems is restricted to authorized personnel on a strictly need-to-know basis. All internal data access is logged and subject to regular audit review.
• Authentication Security: Employee access to systems containing personal data requires multi-factor authentication. Player accounts support two-factor authentication via SMS OTP, which pkr98 strongly recommends enabling.
• Penetration Testing: pkr98's platform infrastructure undergoes regular independent security assessments, including penetration testing by qualified security professionals, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: pkr98 maintains a documented data breach response procedure. In the event of a security incident involving personal data, affected players will be notified without undue delay where notification is required by applicable law or where the incident poses a material risk to affected individuals.

Notwithstanding pkr98's security measures, no data transmission over the internet or storage system is completely immune to security risks. Players are encouraged to maintain strong, unique passwords and to enable two-factor authentication on their pkr98 accounts.

pkr98 respects your rights over your personal data. The following rights are available to all pkr98 players. To exercise any of these rights, contact pkr98 at [email protected] with the subject line "Privacy Rights Request" and include your registered account username.

pkr98 operates a strict 21+ age policy across all platform products and services. pkr98 does not knowingly collect personal data from individuals under the age of 21, and the platform takes active steps to prevent access by minors — including age verification checks at registration and at withdrawal processing.

If pkr98 discovers that personal data has been collected from an individual who is under the age of 21 — whether through misrepresentation at registration or for any other reason — the following actions will be taken immediately:

• The account will be suspended and all access to platform services will be revoked;
• All personal data associated with the account will be flagged for priority deletion subject to any mandatory retention obligations;
• Any deposited funds, net of amounts already withdrawn, will be returned to the original payment source;
• The matter may be reported to the relevant licensing authority where required by licensing conditions.

Parents or guardians who have reason to believe that a minor has accessed or registered on the pkr98 platform are encouraged to contact pkr98 support immediately at [email protected]. pkr98 will treat such reports with the highest priority and respond within 24 hours.

pkr98 may send marketing communications — including promotional offers, bonus notifications, new game announcements, and PSL season promotions — to registered players who have consented to receive such communications during registration or through their account communication preference settings.

Marketing communications are sent exclusively by email to the registered email address. pkr98 does not send unsolicited SMS marketing or use purchased contact lists for marketing purposes.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link at the bottom of any pkr98 marketing email;
• Updating your communication preferences in your pkr98 account settings;
• Contacting pkr98 support at [email protected] with an unsubscribe request.

Opting out of marketing communications does not affect your receipt of transactional account communications — such as deposit confirmations, withdrawal notifications, and security alerts — which are sent regardless of marketing preference as they are necessary for account management.

The pkr98 platform may contain links to the websites of third-party game studios, payment providers, or regulatory bodies for reference and informational purposes. This Privacy Policy applies exclusively to the pkr98 platform. pkr98 is not responsible for the privacy practices of third-party websites and does not endorse or represent any third-party privacy policy.

Before providing personal data to any third-party website — including payment provider websites accessed via deposit or withdrawal flows — players are encouraged to review the applicable third party's privacy policy. pkr98 has no control over and accepts no responsibility for personal data you choose to provide directly to third parties through their own interfaces.

pkr98 reviews this Privacy Policy regularly and reserves the right to update or amend it at any time to reflect changes in data practices, platform functionality, applicable law, or regulatory requirements. The current version number and effective date are displayed at the top of this document.

Where amendments to this policy are material — meaning they significantly affect your rights or how your personal data is processed — pkr98 will notify registered players by email to their registered address at least 7 days before the changes take effect, except where immediate changes are required by law or regulatory instruction. Non-material amendments — such as clarifications, formatting improvements, or minor wording corrections — may be made without advance notice.

The most current version of this Privacy Policy is always available at pkr98.biz/privacy-policy. Continued use of the pkr98 platform following notification of material amendments constitutes acceptance of the revised policy. If you do not accept the revised policy, you should cease using the platform and contact support to arrange account closure.

For any questions, concerns, or requests relating to this Privacy Policy or pkr98's data practices, please contact the pkr98 Privacy team using the details below. Please include your registered account username and a clear description of your query to allow for efficient handling.

• Email: [email protected] (subject line: "Privacy Policy Query")
• Response time: Initial acknowledgment within 24 hours; substantive response within 30 days
• Privacy rights requests: Subject line: "Privacy Rights Request — [Right Type]"

If you are not satisfied with pkr98's response to a privacy query or rights request, you have the right to escalate the matter to the relevant supervisory authority designated by pkr98's licensing jurisdiction, or to seek independent legal advice regarding your data protection rights.