Privacy Policy —
How pk368 Protects Your Data

This Privacy Policy (the "Policy") is issued by pk368 (hereinafter referred to as "pk368", "we", "us" or "our") and applies to all personal data collected through the pk368 platform, website at pk368.cam, and all related products, services and communications (collectively the "Platform").

This Policy explains what personal data we collect, the purposes for which we collect and process it, how we protect it, the circumstances under which it may be shared, how long we retain it, and the rights you hold as a data subject. It should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy.

By accessing the Platform, creating an account or using any of our services, you acknowledge that you have read, understood and agreed to the collection and processing of your personal data as described in this Policy. If you do not agree, you must discontinue use of the Platform immediately.

For the purposes of this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, IP address, device identifiers and financial information.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission and deletion.
• "Data Controller" means pk368, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of pk368 under a data processing agreement.
• "Data Subject" means the natural person whose Personal Data is being processed — in the context of this Policy, you, the Account Holder or visitor.
• "KYC Data" means identity and age verification documents submitted by a Data Subject during the account verification process.
• "Cookies" means small data files placed on your device by the Platform for session management, functionality and analytics purposes.

pk368 collects the following categories of Personal Data:

We do not knowingly collect sensitive personal data beyond what is strictly required for identity verification, age confirmation and AML compliance. We do not collect biometric data beyond what is provided voluntarily during KYC liveness checks.

Personal Data is collected through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, or contacting support.
• Automated technical collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, session cookies and usage logs.
• Third-party verification providers: Identity and age verification data processed through our KYC/AML service providers acting as Data Processors.
• Payment processors: Transaction data generated through payment processing partners when you make deposits or request withdrawals.

pk368 processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to create and maintain your Account, process deposits and withdrawals, and deliver the gaming services you have requested.
• Legal obligation: Processing required to comply with applicable regulatory requirements including KYC age verification, AML (Anti-Money Laundering) screening, and fraud prevention obligations.
• Legitimate interests: Processing necessary for the security of the Platform, fraud detection, platform improvement, and responsible gambling monitoring, provided such interests are not overridden by your privacy rights.
• Consent: Where required by applicable law, we will seek your consent before sending direct marketing communications. You may withdraw consent at any time by contacting support.

pk368 uses Personal Data for the following purposes:

• Creating, managing and maintaining your Account on the Platform;
• Processing deposits, withdrawals and payment transactions;
• Conducting identity and age verification in compliance with KYC obligations;
• Performing AML screening and fraud prevention checks;
• Delivering customer support services in English (and Urdu where requested);
• Administering bonuses, promotions and loyalty programmes;
• Monitoring responsible gambling behaviours and applying self-exclusion or limit controls;
• Ensuring the technical security and integrity of the Platform;
• Analysing Platform usage to improve services, content and user experience;
• Communicating with you about your Account, transactions and material policy changes;
• Complying with applicable legal, regulatory and audit requirements.

pk368 does not sell, rent or trade your Personal Data to third-party advertisers, data brokers or commercial partners for their own marketing purposes. We may share Personal Data with the following categories of third parties strictly as necessary for Platform operations:

• KYC / Identity Verification Providers: To conduct age and identity checks as required by applicable compliance standards.
• Payment Processing Partners: To facilitate deposit and withdrawal transactions. Payment provider names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced as familiar local payment options — their involvement in processing is strictly transactional and does not imply endorsement of gambling.
• Fraud Prevention and AML Service Providers: To screen transactions and account activity for money laundering, fraud or criminal activity.
• Platform Technology Providers: Infrastructure, hosting, analytics and customer support software providers operating as Data Processors under contractual data protection obligations.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order or legitimate regulatory request. pk368 may also disclose data to prevent imminent harm or criminal activity.

All third-party Data Processors are required to implement appropriate technical and organisational security measures and to process Personal Data only in accordance with pk368's documented instructions.

As an online platform with global infrastructure, pk368 may transfer Personal Data to jurisdictions outside your country of residence, including jurisdictions that may have different data protection standards. Where such transfers occur, pk368 takes steps to ensure that appropriate safeguards are in place, such as data processing agreements that include adequate data protection obligations, or reliance on legally recognised transfer mechanisms.

If you are based in Pakistan and your data is transferred internationally, such transfers are conducted on the basis of operational necessity for account management and payment processing, consistent with the purposes described in this Policy.

pk368 retains Personal Data for the following periods:

• Active Account Data: Retained for the duration of your Account and for a period thereafter as required by applicable legal, regulatory and compliance obligations (typically a minimum of five years following Account closure in line with standard AML record-keeping requirements).
• KYC Documents: Retained for the period required by the operator's licensing authority and applicable AML regulations, typically five years from the date of last account activity or Account closure, whichever is later.
• Transaction Records: Retained for a minimum of five years following the date of transaction in accordance with financial record-keeping requirements.
• Support Communications: Retained for up to three years from the date of the last interaction, unless a longer period is required by applicable law.
• Technical and Usage Data: Anonymised or deleted within twelve months of collection where not required for security or compliance purposes.

Following the expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

pk368 implements a range of technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration or destruction. These measures include, without limitation:

• HTTPS/TLS encryption of all data in transit between your device and the Platform;
• Password hashing — passwords are never stored in plain text;
• Optional two-factor authentication (2FA) for Account login;
• Access controls limiting internal access to Personal Data on a need-to-know basis;
• Regular security assessments of Platform infrastructure;
• Secure, encrypted storage of KYC documents and financial records.

No electronic transmission or data storage system can guarantee absolute security. pk368 cannot warrant that Personal Data will be entirely free from risk of interception or misuse by third parties. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying us immediately of any suspected unauthorised access.

The Platform uses cookies and similar tracking technologies (including web beacons and local storage) for the following purposes:

• Essential Cookies: Required for the Platform to function, including session management, login authentication and security token storage. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gambling limits.
• Analytics Cookies: Used to collect anonymised data about Platform usage patterns to improve the user experience. pk368 does not use analytics data to build individual advertising profiles.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. pk368 does not use third-party advertising cookies or behavioural tracking cookies for commercial advertising purposes.

Subject to applicable law, you have the following rights in relation to your Personal Data held by pk368:

• Right of Access: You may request a copy of the Personal Data pk368 holds about you at any time.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data, subject to our legal obligation to retain certain data for AML and regulatory compliance purposes.
• Right to Restriction of Processing: You may request that processing of your Personal Data be restricted in certain circumstances, such as where you contest the accuracy of the data.
• Right to Data Portability: You may request a copy of your Personal Data in a structured, machine-readable format where technically feasible.
• Right to Object: You may object to processing of your Personal Data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the pk368 support team with your full name and registered email address and a description of your request. We will respond within the timeframe required by applicable law. We may request additional verification of your identity before processing data subject requests.

The Platform is strictly for adults aged 18 years or older, or the higher minimum age required by the operator's license jurisdiction. pk368 does not knowingly collect Personal Data from individuals below the applicable minimum age.

If pk368 discovers or has reason to believe that Personal Data has been submitted by a minor, the relevant Account will be immediately closed, all data processed through that Account will be deleted (subject to any applicable legal retention requirements), and any winnings associated with that Account will be forfeited.

Parents and guardians who believe a minor in their household has accessed the Platform should contact pk368 support immediately. We take child protection seriously and will act promptly on all such reports.

Financial data generated when you make deposits or request withdrawals is processed through our payment processing partners. Payment provider names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are familiar local payment references — their mention on the Platform does not constitute a claim that they endorse online gambling or that they are guaranteed to be available as payment methods at any given time.

pk368 does not store full payment card numbers, full bank account numbers or mobile wallet credentials on its own servers. Full financial credentials processed during payment are handled directly by our payment processing partners, who are required to maintain appropriate security standards.

Transaction records, including deposit and withdrawal amounts and payment method references, are retained for the period required by applicable financial record-keeping and AML compliance obligations.

pk368 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements or Platform operations. Material changes will be communicated to Account Holders via the registered email address or by a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent amendment. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the updated Policy. If you disagree with any amendment, you must cease using the Platform and contact support to close your Account.

For any questions, concerns or requests regarding this Privacy Policy or the processing of your Personal Data, please contact the pk368 Data Support team. We are available 24 hours a day, 7 days a week in English, with Urdu assistance also available on request.

Support contact (plain text — not a clickable link):

[email protected]

All data subject requests will be acknowledged within 72 hours and resolved within the timeframe required by applicable law. Where additional identity verification is required before processing your request, we will notify you promptly.

pk368 serves players across Pakistan, including in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and all other cities and regions across the country.