pk388 Privacy Policy — How We Protect Your Personal Data

pk388 is an internationally licensed online gaming platform operating at pk388.org. We provide Pakistani players with access to live casino games, sports betting markets including PSL and international cricket, slot machine titles, and related entertainment services. pk388 acts as the data controller in respect of all personal data collected through the Platform and is responsible for ensuring that such data is handled in accordance with applicable data protection law and the standards imposed by our international gaming licence.

For all privacy-related queries, data subject requests, or concerns about how your personal data is handled by pk388, please contact our Data Protection team using the details set out in Section 15 of this Policy.

pk388 collects the following categories of personal data from players and visitors to the Platform:

We do not collect special categories of sensitive data (such as health information, religious beliefs, or biometric data) except where strictly necessary for responsible gaming assessments and only with your knowledge.

pk388 collects personal data through the following channels:

• Direct submission: Information you provide when creating an account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your account settings.
• Automated technical collection: Technical data collected automatically when you visit or use the pk388 Platform, including IP addresses, session data, and device identifiers collected via server logs and session management systems.
• Third-party verification partners: Identity and payment verification data received from our KYC and payment processing partners as part of the account verification workflow.
• Payment providers: Confirmation data received from JazzCash, EasyPaisa, HBL, UBL, SadaPay, and other payment partners upon processing transactions.
• Cookies and tracking technologies: Behavioural data collected through first-party cookies as described in Section 7 of this Policy.

pk388 processes your personal data for the following specific purposes:

• Account Management: Creating and maintaining your pk388 account, processing login requests, and managing your account preferences and settings.
• Identity Verification (KYC): Verifying your identity and age (minimum 21 years) in compliance with our international gaming licence requirements and applicable anti-money laundering regulations.
• Payment Processing: Facilitating PKR deposits, processing withdrawal requests, and maintaining accurate transaction records for your account.
• Gaming Service Delivery: Enabling access to casino games, sports betting markets, and all other pk388 Platform features.
• Customer Support: Responding to your queries, complaints, and support requests through live chat and email channels.
• Legal & Regulatory Compliance: Fulfilling obligations under our international gaming licence, including anti-money laundering (AML) monitoring, fraud prevention, and reporting to licensing authorities where required.
• Responsible Gaming: Monitoring gaming patterns for indicators of problem gambling and administering responsible gaming tools including deposit limits, self-exclusion, and cooling-off periods.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, account takeovers, and prohibited conduct as defined in our Terms & Conditions.
• Platform Improvement: Analysing anonymised usage data to improve Platform performance, game offerings, and user experience.
• Marketing Communications: Sending promotional offers and bonus notifications to players who have opted in to receive such communications. You may opt out at any time through your account settings.

pk388 processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a pk388 Account holder — including account management, payment processing, and gaming service delivery.
• Legal Obligation: Processing required to comply with applicable law, including KYC obligations, AML reporting duties, and conditions imposed by our international gaming licence.
• Legitimate Interests: Processing carried out for pk388's legitimate business interests, including fraud prevention, security monitoring, and platform analytics — where such interests are not overridden by your fundamental rights.
• Consent: Processing based on your explicit consent, including marketing communications and optional data uses. Where consent is the basis for processing, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

pk388 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, SadaPay, and cryptocurrency network operators, to the extent necessary to process your financial transactions.
• KYC Verification Partners: Third-party identity verification service providers who assist with CNIC validation and document authentication as part of our mandatory verification process.
• Game Providers: Software providers including PG Soft, Pragmatic Play, and other licensed game studios, who may receive anonymised session data for game performance and integrity purposes.
• IT and Hosting Providers: Data centre and cloud infrastructure providers who host the pk388 Platform infrastructure, subject to strict data processing agreements.
• Regulatory and Law Enforcement Authorities: Disclosure to our licensing authority, financial intelligence units, or law enforcement agencies where required by applicable law, court order, or our licensing conditions.
• Professional Advisers: Legal counsel, auditors, and compliance consultants who provide professional services to pk388, subject to confidentiality obligations.

pk388 uses first-party cookies and similar tracking technologies to operate the Platform effectively. We do not use third-party advertising cookies. The following cookie types are used:

• Strictly Necessary Cookies: Essential for Platform operation, including session management, login authentication, and security functions. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your account preferences, language settings, and gaming display choices across sessions.
• Analytics Cookies: Collect anonymised data about how players use the Platform to help us improve the gaming experience. No personally identifiable information is included in analytics data.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and security threats.

You may adjust cookie preferences through your browser settings. Please note that disabling certain cookies may affect Platform functionality. pk388 does not use cross-site tracking cookies or share cookie data with advertising networks.

pk388 retains personal data for the following periods, after which data is securely deleted or anonymised:

When a retention period expires, pk388 securely destroys or anonymises the relevant data. Anonymised data (which cannot be used to identify any individual) may be retained indefinitely for Platform analytics purposes.

pk388 operates under an international gaming licence and may process or store certain categories of personal data on servers located outside Pakistan. Where personal data is transferred internationally, pk388 ensures that such transfers are protected by appropriate safeguards, including:

• Contractual obligations binding the receiving party to data protection standards equivalent to those applied by pk388.
• Selection of international hosting and processing partners who maintain recognised security certifications (such as ISO 27001).
• Data minimisation in cross-border transfers — only the data strictly necessary for the international processing purpose is transferred.

As a pk388 member, you hold the following rights over your personal data. These rights may be exercised by contacting our Data Protection team using the details in Section 15:

• Right of Access: Request a copy of the personal data pk388 holds about you and information about how it is being used.
• Right to Rectification: Request correction of inaccurate or incomplete personal data held in your pk388 account.
• Right to Erasure: Request deletion of your personal data, subject to exceptions where continued retention is required by applicable law or licensing obligations.
• Right to Restriction: Request that processing of your personal data is temporarily restricted in certain circumstances, for example while a data accuracy dispute is being resolved.
• Right to Data Portability: Receive a copy of personal data you have provided to pk388 in a structured, machine-readable format.
• Right to Object: Object to processing of your personal data where pk388 relies on legitimate interests as the legal basis, including objection to direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

pk388 will respond to all valid data subject requests within 30 days of receipt. We may request proof of identity before processing data subject requests to protect against unauthorised access to your information.

The pk388 Platform is strictly restricted to individuals aged 21 years and over. pk388 does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory component of the pk388 account registration and KYC process, and we take underage access to online gaming extremely seriously.

If pk388 becomes aware that personal data has been collected from a person under the minimum age of 21, that account will be immediately suspended, the data will be deleted as soon as legally permissible, and the matter will be reviewed in accordance with our licensing obligations.

If you are a parent or guardian and believe that a minor has accessed pk388, please contact our support team immediately at [email protected] and we will take immediate action.

pk388 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and pk388 servers is encrypted to prevent interception.
• AES-256 Encryption at Rest: Sensitive personal data stored in pk388 databases is encrypted at rest.
• Access Controls: Personal data systems are accessible only to authorised pk388 personnel on a strict need-to-know basis, with role-based access controls and multi-factor authentication enforced.
• Regular Security Audits: pk388 conducts periodic internal security reviews and engages third-party penetration testing to identify and remediate vulnerabilities.
• Intrusion Detection: Automated systems monitor Platform infrastructure for anomalous access patterns and potential security incidents in real time.
• Incident Response: pk388 maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you in accordance with our legal obligations.

pk388 processes certain categories of gaming data specifically to support responsible gaming objectives. This includes monitoring deposit patterns, session durations, loss trajectories, and self-exclusion requests to identify players who may benefit from responsible gaming intervention.

The processing of gaming behaviour data for responsible gaming purposes is carried out in the public interest and pursuant to our licensing obligations. This data is used:

• To administer deposit limit, loss limit, and session time tools activated by players in their account settings.
• To identify unusual or escalating gaming patterns that may indicate problem gambling behaviour.
• To enforce self-exclusion periods requested by players and to prevent re-registration during an active exclusion window.
• To comply with responsible gaming reporting obligations under our international gaming licence.

pk388 treats responsible gaming data with the highest level of sensitivity and care. Such data is not used for marketing purposes and is never shared with third parties except where required by our licensing authority. Visit our Responsible Gaming page to access all available responsible gaming tools. 21+ only.

pk388 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our licensing obligations. Material changes to this Policy will be communicated to registered Account holders via the Platform's notification system and/or by email to the registered account address, providing reasonable notice before the changes take effect.

The current version of this Privacy Policy is always accessible at pk388.org/privacy-policy. The "Effective Date" at the top of this document identifies the version currently in force. Your continued use of the pk388 Platform following notification of material changes constitutes acceptance of the updated Policy.

For all privacy-related requests, data subject rights exercises, questions about this Privacy Policy, or data protection complaints, please contact the pk388 Data Protection team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line and provide your pk388 account username to help us locate your records promptly.
• Live Chat: Available 24/7 inside your pk388 Account dashboard — for urgent privacy concerns or where you require immediate assistance.

pk388 takes all privacy complaints seriously and will acknowledge your contact within 2 business days and provide a substantive response within 30 calendar days. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant supervisory authority designated by our licensing jurisdiction.