pkaz Privacy Policy — How We Handle Your Personal Data

pkaz ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who interact with the pkaz online casino and sports betting platform (the "Platform"). This Privacy Policy ("Policy") describes in detail the types of personal data we collect, the purposes for which that data is used, the legal bases that justify such processing, the circumstances in which data may be shared with third parties, the measures we take to protect your data, and the rights available to you as a data subject.

This Policy applies to all personal data collected through: (a) the pkaz website and mobile platform; (b) account registration and the KYC identity verification process; (c) financial transactions including deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT; (d) customer support interactions via live chat and email; (e) participation in promotions, bonuses, and the pkaz VIP loyalty programme; and (f) use of responsible gaming tools and self-exclusion facilities.

pkaz is an internationally licensed gaming operator. Our licence obliges us to maintain specific data protection standards as a condition of continued operation. We take these obligations seriously — not merely as a regulatory requirement but as a foundational commitment to the players who trust us with their information and their money.

2.1 For the purposes of applicable data protection law, the data controller in respect of personal data collected through the pkaz platform is the pkaz platform operator — the licensed entity responsible for operating pkaz.bid and all associated services under its international gaming licence.

2.2 Full corporate details of the data controller, including registered address and licence number, are available upon written request submitted to [email protected]. These details are provided on request rather than published on the public platform for operational security reasons consistent with standard practice in the licensed gaming industry.

2.3 Where pkaz engages third-party service providers who process personal data on pkaz's behalf (for example, payment processors, identity verification services, or cloud infrastructure providers), those third parties act as data processors under documented data processing agreements that bind them to the same data protection standards applicable to pkaz as data controller.

pkaz collects the following categories of personal data, depending on how you interact with the platform:

3.1 Registration Data. When you open a pkaz account, we collect: full legal name; date of birth; nationality; Pakistani mobile number; email address; username; password (stored in hashed, non-reversible form); and your preferred currency (PKR).

3.2 Identity Verification (KYC) Data. To comply with our gaming licence's mandatory age verification and AML requirements, we collect: CNIC number and a copy of the front and back of your CNIC; proof of address documentation where required; source of funds information for enhanced due diligence; and selfie or video verification materials where required by our KYC procedures.

3.3 Financial Data. We collect data necessary to process deposits and withdrawals including: JazzCash account number; EasyPaisa registered mobile number; bank account details (for HBL, UBL, or Meezan Bank transfers); USDT wallet address; transaction amounts and timestamps; and account balance history. pkaz does not store full payment card numbers.

3.4 Gaming Activity Data. We maintain records of all gaming and betting activity on your pkaz account including: games played and bet amounts; PSL and other sports bets placed; game outcomes and winnings; bonus claims and wagering progress; and session timestamps and duration.

3.5 Technical Data. When you access pkaz, our systems automatically record: IP address; device type, model, and operating system; browser type and version; session identifiers and cookies; approximate geolocation derived from IP address; and platform access timestamps.

3.6 Communication Data. If you contact pkaz support, we retain records of: live chat transcripts; email correspondence; the content of any complaint or dispute submission; and records of responsible gaming requests including self-exclusion applications.

3.7 Voluntary Data. Data you choose to provide in optional profile fields, survey responses, or promotional participation is also collected and used for the purposes described in Section 4.

pkaz uses the personal data described in Section 3 for the following purposes:

4.1 Marketing Communications. pkaz will only send promotional emails, SMS notifications, or in-platform messages about offers, bonuses, and gaming news where you have provided explicit consent during account registration or have subsequently opted in to such communications. You may withdraw marketing consent at any time by contacting [email protected] or using the unsubscribe option in any marketing email. Withdrawal of marketing consent does not affect service communications necessary for account operation.

4.2 Automated Decision-Making. pkaz's AML and fraud detection systems use automated analysis of transaction and gameplay patterns to identify potentially suspicious activity. Where an automated decision results in an account restriction, you have the right to request human review of that decision by contacting pkaz support. pkaz does not use automated profiling for decisions that produce significant legal effects on players beyond AML and fraud controls.

pkaz processes personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the pkaz gaming and betting services you have requested — including account management, game delivery, and payment processing — is carried out on the basis of the contract between pkaz and each registered player.
• Legal Obligation: Processing required to comply with pkaz's gaming licence conditions, AML legislation, KYC requirements, responsible gaming obligations, and any other applicable legal or regulatory requirement is carried out on the basis of legal obligation.
• Legitimate Interest: Processing for fraud prevention, platform security, gameplay analytics, customer service quality improvement, and responsible gaming monitoring is carried out where pkaz has a legitimate interest that is not overridden by your rights and interests. Where legitimate interest is the basis, pkaz has documented its balancing assessment.
• Consent: Processing for marketing communications and optional analytics cookies is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6.1 pkaz shares personal data with third parties only in the circumstances set out in this section. pkaz does not sell, rent, or trade personal data for commercial purposes unrelated to platform operation.

6.2 Payment Processors. To facilitate deposits and withdrawals, pkaz shares necessary financial and identity data with our payment partners — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and the USDT network. Data shared is limited to what is required for the specific transaction. Each payment partner operates under its own privacy policy and security standards.

6.3 Identity Verification Providers. pkaz uses third-party KYC and identity verification service providers to assist with CNIC verification and age confirmation. These providers access identity documentation submitted during the verification process and process it in accordance with their own data processing agreements with pkaz.

6.4 Regulatory Authorities. pkaz is required under its gaming licence and applicable AML legislation to report certain transactions and player information to relevant regulatory and law enforcement authorities. Such disclosures are made without prior notice to the player where legally required — for example, suspicious transaction reports filed under AML obligations.

6.5 Technology and Infrastructure Providers. pkaz's platform is hosted on cloud infrastructure provided by third-party technology vendors. These vendors process data solely on pkaz's instructions under documented data processing agreements and may not use pkaz player data for any other purpose.

6.6 Game Content Providers. Third-party game studios whose titles are available on pkaz may receive aggregated, anonymised gaming activity data for RTP audit and compliance purposes. Individual player identities are not shared with game providers without explicit consent or legal requirement.

6.7 Business Transfers. In the event of a merger, acquisition, or sale of all or part of pkaz's business, player data may be transferred to the acquiring entity as part of that transaction. Affected players will be notified in advance and given the opportunity to close their accounts before any such transfer takes effect.

7.1 pkaz operates as an internationally licensed gaming platform. Personal data collected from Pakistani players may be processed in or transferred to countries outside Pakistan, including the jurisdiction in which pkaz's gaming licence is issued and countries where our technology and service providers operate.

7.2 Where personal data is transferred outside Pakistan to countries that do not have equivalent data protection standards, pkaz implements appropriate safeguards including standard contractual clauses with service providers, data processing agreements imposing equivalent protection obligations, and technical security measures including encryption in transit and at rest.

7.3 All third-party service providers who process pkaz player data in international locations are contractually prohibited from using that data for any purpose other than the specific service they provide to pkaz, and are required to maintain security standards consistent with those pkaz applies internally.

8.1 pkaz uses cookies and similar tracking technologies on the platform. Cookies are small data files stored on your device that help us deliver a functional, personalised, and secure gaming experience.

8.2 Strictly Necessary Cookies. These cookies are essential for the pkaz platform to function. They include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and load balancing cookies that ensure platform stability. These cookies cannot be disabled without preventing platform access.

8.3 Functional Cookies. These cookies remember your preferences — language settings, responsible gaming tool configurations, and gameplay preferences — so you do not need to reset them on each visit. They are set on the basis of legitimate interest and improve your experience without tracking you for advertising purposes.

8.4 Analytics Cookies. With your consent, pkaz uses analytics cookies to understand how players navigate the platform — which games are accessed most frequently, where players encounter difficulties, and how responsible gaming tool usage patterns develop over time. This data is used in anonymised or aggregated form to improve the pkaz platform and is not sold to third parties.

8.5 Managing Cookies. You can control cookies through your browser settings, which allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from accessing your pkaz account. You can withdraw consent to analytics cookies at any time by adjusting your preferences in the pkaz account settings or by contacting [email protected].

pkaz retains personal data for the following periods unless a longer retention period is required by applicable law or regulatory obligation:

• Account Registration Data: For the duration of the active account relationship, plus 7 years following account closure, in accordance with gaming licence AML record-keeping requirements.
• KYC and Identity Verification Data: 7 years from the date of verification or from the date of account closure, whichever is later, in accordance with AML legislation applicable under our gaming licence.
• Financial Transaction Records: 7 years from the date of the transaction, consistent with AML and financial record-keeping obligations.
• Gaming Activity Logs: 5 years from the date of each gaming session or transaction, for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• Customer Support Communications: 3 years from the date of the interaction, unless the communication relates to an unresolved dispute in which case records are retained until final resolution plus 2 years.
• Marketing Consent Records: For the duration of the consent plus 3 years after withdrawal, to demonstrate compliance with consent requirements.
• Technical Log Data (IP addresses, session data): 12 months from collection, unless a specific event (fraud investigation, security incident) requires longer retention.

9.1 At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data derived from gameplay and platform analytics may be retained indefinitely for statistical purposes, as anonymised data falls outside the scope of data protection law.

9.2 Requests for early deletion of personal data are subject to pkaz's legal obligations — data that must be retained for regulatory purposes cannot be deleted early regardless of a player's request. Where early deletion is possible, pkaz will action it within 30 days of the verified request.

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by pkaz:

• Right of Access: You may request a copy of the personal data pkaz holds about you. We will respond to verified access requests within 30 days.
• Right to Rectification: If personal data we hold about you is inaccurate or incomplete, you may request that we correct or supplement it. Corrections to KYC-verified data may require re-submission of supporting documents.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our legal retention obligations — data we are required by law to retain cannot be erased early.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances — for example, while a dispute about data accuracy is pending.
• Right to Data Portability: Where processing is carried out by automated means on the basis of contract or consent, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interest at any time. pkaz will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
• Right Not to Be Subject to Automated Decisions: You have the right to request human review of any significant automated decision made about your pkaz account, as described in Section 4.2.

11.1 The pkaz platform is strictly intended for adults aged 21 years and above. pkaz does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the pkaz account registration and KYC process — no account may be opened without successfully confirming the applicant's age against CNIC documentation.

11.2 If pkaz becomes aware that personal data has been collected from an individual who is under 21 years of age, we will immediately close the associated account, delete all collected data (subject to any regulatory obligation to retain evidence of the underage access incident for compliance purposes), and — where legally required — notify relevant authorities.

11.3 Parents and guardians who suspect that a minor has accessed or registered on the pkaz platform should contact [email protected] immediately. pkaz treats such reports as high priority and will investigate and resolve them as a matter of urgency.

11.4 pkaz recommends that parents and guardians of minors use parental control software to restrict access to online gambling platforms as an additional precautionary measure, independent of the technical controls pkaz maintains.

12.1 pkaz implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and pkaz servers
• Encrypted storage for all sensitive data at rest, including KYC documents and financial records
• Password hashing using industry-standard algorithms (passwords are never stored in plain text)
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Multi-factor authentication for all pkaz administrative system access
• Regular third-party penetration testing and security audits as required by licence conditions
• Comprehensive security incident response and data breach notification procedures
• Employee data protection training covering handling of player data and security awareness

12.2 While pkaz takes all reasonable and proportionate steps to protect your personal data, no internet-based system can guarantee absolute security. You can reduce your own risk by maintaining strong, unique pkaz login credentials, enabling two-factor authentication on your account, and contacting pkaz immediately if you suspect any unauthorised access.

13.1 pkaz uses personal data — particularly gaming activity data, deposit and withdrawal patterns, and session duration records — to support its responsible gaming programme. This processing is carried out on the basis of our legal obligation under the gaming licence and our legitimate interest in protecting player welfare.

13.2 Specifically, pkaz uses this data to: identify patterns consistent with problem gambling behaviour; trigger responsible gaming alerts and self-assessments; enforce deposit limits and session boundaries set by the player; process and enforce self-exclusion requests; and monitor compliance with cool-off periods and exclusion decisions.

13.3 Data collected as part of responsible gaming processes — including self-exclusion requests, limit-setting history, and responsible gaming communications — is retained for the full duration required by our gaming licence obligations. This data may not be deleted on request where regulatory retention requirements apply, as it is needed to ensure exclusions and restrictions remain enforced.

13.4 pkaz shares anonymised, aggregated responsible gaming data with regulators and licence supervisory bodies as required under our licence conditions. Individual player identities are not included in such reports.

14.1 pkaz may update or amend this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, regulatory requirements, or business operations. The current version of this Policy is always published at pkaz.bid/privacy-policy.

14.2 Material changes to this Policy — changes that significantly affect how your personal data is processed or your privacy rights — will be communicated to registered players via email to the address registered on the account, or via a prominent notice on the pkaz platform, at least 14 calendar days before the changes take effect.

14.3 Non-material changes — such as corrections to typographical errors, updated contact information, or clarifications that do not change the substance of our data practices — may take effect immediately without prior notice.

14.4 Continued use of the pkaz platform after the effective date of any revision to this Policy constitutes acknowledgement of the updated Policy. If you object to any changes, you should cease using the platform and request account closure before the effective date of the change.

15.1 If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how pkaz has handled your personal data, please contact us:

• Email: [email protected] — please use the subject line "Privacy Query" or "Data Rights Request" so your message is routed to the appropriate team
• Response Time: pkaz will acknowledge privacy queries within 48 hours and provide a substantive response within 30 calendar days
• Languages: Queries may be submitted in English or Urdu

15.2 If you are not satisfied with pkaz's response to your privacy query or data rights request, you have the right to escalate the matter to the data protection supervisory authority applicable under our gaming licence jurisdiction. Details of the relevant supervisory authority are available from pkaz support on request.

15.3 pkaz treats all privacy complaints seriously and operates an internal escalation process for privacy matters that cannot be resolved at first-line support level. Unresolved privacy complaints are reviewed by the pkaz Compliance Officer, whose decision represents the final internal response before regulatory escalation.