Privacy Policy — pak368

This Privacy Policy ("Policy") is issued by pak368 ("we", "us", "our", the "Platform") and applies to all users ("you", "your", "User") who access or interact with the pak368 website located at pak368.cam and any associated services, applications or tools.

pak368 is an English-language online gaming information and entertainment platform designed for Pakistani users. In the course of providing our services, we collect, process and store certain personal information about you. This Policy sets out our practices with respect to that data and describes your rights in full.

This Policy is incorporated by reference into pak368's Terms & Conditions and should be read alongside them. By accessing or using the Platform, you confirm that you have read and understood this Policy and that you consent to our data practices as described herein to the extent that consent forms the applicable legal basis for processing.

We are committed to handling your personal data responsibly, lawfully and with transparency. If you have any questions about this Policy or our data practices, please contact us using the details set out in Section 16.

In this Policy, the following terms carry the meanings set out below:

pak368 acts as the Data Controller in respect of Personal Data collected and processed through the Platform. As Data Controller, pak368 is responsible for determining the purposes for which your Personal Data is collected and the manner in which it is processed.

Where pak368 engages third-party service providers — such as identity verification vendors, payment processors or analytics providers — those parties act as Data Processors under contractual data processing agreements that require them to handle your data solely in accordance with pak368's instructions and applicable data protection standards.

For all data-related enquiries, including requests to exercise your rights under Section 13, please contact us using the details in Section 16.

We collect Personal Data from you in several ways: directly when you register or interact with the Platform, automatically when you use it, and in certain cases from third-party verification partners. The categories of data we collect are set out below.

4.1 Registration & Account Data

• Full legal name, date of birth and gender (where requested);
• Email address and mobile telephone number;
• Username and encrypted password;
• Residential address, including city and country (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar);
• Preferred language and communication preferences.

4.2 Identity Verification (KYC) Data

• Copy of a valid CNIC (Computerized National Identity Card) or passport — front and reverse;
• Proof of address documentation (e.g., utility bill, bank statement dated within three months);
• Selfie image and/or liveness check biometric data, as required by the verification process;
• Payment method ownership documentation where applicable.

4.3 Financial & Transaction Data

• Deposit and withdrawal amounts in PKR or other supported currencies;
• Payment method details (partial card numbers, mobile wallet references — not full card numbers in unencrypted form);
• Transaction timestamps, reference numbers and processing status records;
• Bonus claim history and wagering activity records.

4.4 Technical & Usage Data

• IP address, browser type and version, operating system and device type;
• Session timestamps, pages viewed, features accessed and clickstream data;
• Geolocation data at session level (country and approximate region, not precise GPS);
• Cookies and similar tracking technology data (see Section 11).

4.5 Communications Data

• Records of Live Chat and email support interactions;
• Feedback, complaints and dispute correspondence;
• Responsible gambling self-assessment responses and limit-setting records.

pak368 processes your Personal Data for the following defined purposes:

Where applicable data protection law requires a legal basis for processing Personal Data, pak368 relies on the following bases:

• Contractual necessity: Processing required to perform our obligations to you under the Terms & Conditions — including account registration, transaction processing and customer support;
• Legal obligation: Processing required to comply with AML, KYC, regulatory reporting and other legal obligations applicable to the operator's licensing jurisdiction;
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement and responsible gambling management, where such interests are not overridden by your fundamental rights;
• Consent: Where we rely on your consent — for example, for optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing;
• Vital interests: In exceptional circumstances, we may process data where it is necessary to protect your vital interests or those of another person.

pak368 does not sell your Personal Data to unaffiliated third parties for their own marketing or commercial purposes. We may share your data with the following categories of recipient only to the extent necessary for the stated purpose:

• Identity verification providers: Third-party KYC and liveness-check platforms engaged to verify your CNIC, passport or other identity documents on our behalf under strict contractual data processing terms;
• Payment processors: Financial intermediaries and payment gateway providers — which may include services familiar to Pakistani users such as local bank transfer processors, mobile wallet integrators or international payment networks — engaged solely to process your transactions;
• Regulatory and law enforcement authorities: Where required by applicable law, court order or regulatory mandate, we may disclose your data to competent authorities without prior notice to you;
• AML and fraud screening services: Third-party platforms used for sanctions screening, politically exposed person (PEP) checks and transaction monitoring as required by the operator's AML programme;
• IT infrastructure and hosting providers: Cloud and server infrastructure vendors who host Platform data under data processing agreements requiring equivalent data protection standards;
• Professional advisers: Legal counsel, auditors and insurers, where necessary and subject to applicable professional confidentiality obligations;
• Business successors: In the event of a merger, acquisition or transfer of business assets, your data may be transferred to a successor entity, subject to equivalent privacy protections.

pak368 operates as an international online platform. Your Personal Data may be transferred to, stored in or processed in countries other than Pakistan, including the jurisdiction in which the operator's license is held. These jurisdictions may have data protection laws that differ from those applicable in Pakistan.

Where such transfers occur, pak368 takes reasonable steps to ensure that appropriate safeguards are in place — including contractual clauses requiring Data Processors to comply with data protection standards equivalent to those described in this Policy. By using pak368, you acknowledge and consent to such international transfers as necessary for the provision of our services.

pak368 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulation. The following general retention principles apply:

• Active account data: Retained for the duration of your Account and for a minimum period following account closure as required by AML, KYC and regulatory record-keeping obligations (typically a minimum of five years in most licensing jurisdictions);
• KYC and identity documents: Retained in accordance with applicable AML retention requirements — generally for a minimum of five years from the date of verification or account closure, whichever is later;
• Transaction records: Retained for the period required by the operator's licensing and financial record-keeping obligations;
• Support communications: Retained for a reasonable period to support dispute resolution and service quality review;
• Technical and usage data: Retained in aggregated or pseudonymised form for analytics purposes for a period consistent with the stated legitimate interests;
• Marketing consent records: Retained for as long as you remain opted in, and for a reasonable period thereafter as evidence of consent and opt-out requests.

When data is no longer required, it is securely deleted or anonymised in accordance with our data disposal procedures.

pak368 implements and maintains a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration or disclosure. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the Platform is encrypted using HTTPS protocols;
• Password hashing: Account passwords are stored in hashed, salted form — plain-text passwords are never stored;
• Access controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis with role-based access controls;
• KYC document security: Identity documents submitted for verification are handled through secure encrypted storage with access limited to authorised verification staff;
• Two-factor authentication: Account-level 2FA is available and recommended for all users;
• Monitoring and logging: Platform activity is monitored for anomalous patterns indicative of security incidents or unauthorized access;
• Vendor due diligence: Third-party Data Processors are assessed for data security standards before engagement and subject to contractual security requirements.

Notwithstanding these measures, no internet-based transmission or electronic storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own login credentials and for notifying support immediately of any suspected unauthorized access to your Account.

pak368 uses cookies and similar tracking technologies to operate certain Platform functions, maintain session states, prevent fraud and analyse usage patterns. The principal categories of cookies deployed are as follows:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use core Platform features, including login. Where applicable law requires consent for non-essential cookies, we will seek it before deploying such technologies.

pak368 is strictly an adults-only platform. Access to gambling features is limited to persons aged 18 years and above — or the higher minimum age required by the operator's applicable license jurisdiction. We do not knowingly collect Personal Data from minors under the age of 18.

Age verification is performed as part of the mandatory KYC process. Where it is determined — whether through KYC review or any other means — that a user is under the minimum required age, the Account will be immediately suspended, all deposits will be returned and no winnings or bonuses will be paid. Any Personal Data collected from an underage user will be deleted as promptly as is practicable.

Subject to applicable data protection law and where pak368 acts as Data Controller, you have the following rights in respect of your Personal Data. To exercise any of these rights, please contact us using the details in Section 16. We will respond to all valid requests within a reasonable timeframe and in any event within 30 days of receipt.

pak368 serves Pakistani users across cities including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. Pakistan does not currently have a comprehensive standalone data protection law equivalent to the European GDPR, although the Personal Data Protection Bill has been under consideration. We apply data protection standards consistent with best international practice regardless of the applicable local legal framework.

Pakistani users should be aware of the following specific considerations:

• Identity documents: CNIC data submitted for KYC purposes is handled with the highest level of security and is not shared with third parties except as described in Section 7. NADRA and related Pakistani government databases are not accessed by pak368 without your consent and applicable authority;
• Payment data: Where local payment references such as Easypaisa, JazzCash, Raast or bank details from HBL, UBL, Meezan Bank or Bank Alfalah are provided for transaction purposes, that data is processed solely to facilitate your transactions and is not used for profiling or marketing without your explicit consent;
• Legal framework: pak368 does not claim to hold any authorization from the Government of Pakistan, PTA, State Bank of Pakistan or any other Pakistani authority in respect of data processing activities;
• Applicable law: Users are responsible for understanding their own obligations under applicable Pakistani law when interacting with international online services.

pak368 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — affecting how we collect, use or share your Personal Data — we will provide advance notice by posting a visible notification on the Platform and, where practicable, by email to your registered address.

The effective date shown at the top of this document will be updated to reflect the most recent revision. Your continued use of the Platform following any amendment constitutes your acknowledgment of and agreement to the updated Policy. If you do not accept any amendment, you should cease using the Platform and contact support to request account closure.

We encourage you to review this Policy periodically to remain informed of how pak368 handles your Personal Data.

For any privacy-related enquiries, data rights requests or complaints regarding this Policy, please contact the pak368 Data Privacy team through the following channels. All communications are handled in English, with Urdu language support also available.