pk38 Privacy Policy

1 Who We Are

pk38 ("pk38", "we", "us", "our") is the operator of the online gaming platform accessible at pk38.bio. pk38 operates under an international gaming licence and provides online casino, sports betting, live casino, Teen Patti, slots and related gaming services primarily to players located in Pakistan.

For the purposes of this Privacy Policy, pk38 is the data controller responsible for the personal data of registered players and visitors to the pk38 platform. Any queries relating to the handling of your personal data may be directed to the pk38 Data Privacy team via the contact details provided in Section 15 of this Policy.

This Privacy Policy applies to all personal data collected through the pk38 website at pk38.bio, any associated mobile web interface, and all communications between pk38 and its registered players including email and support chat.

2 Data We Collect

pk38 collects personal data from players through multiple channels, including account registration, KYC verification submissions, payment transactions, platform usage and direct communications with our support team. The categories of personal data we collect are set out in the table below.

pk38 does not collect special category sensitive data such as biometric data, health information or racial or ethnic origin data, except where expressly required by applicable law or licensing conditions and with your explicit prior consent.

3 How We Use Your Data

pk38 uses your personal data only for the purposes for which it was collected or for purposes that are compatible with those original purposes. The primary uses of your personal data are as follows:

• Account Management: To create, maintain and operate your pk38 player account, including processing login authentication, account settings changes and account closure requests.
• Identity Verification: To verify your identity and age (21+) in accordance with the requirements of our international gaming licence and applicable anti-money laundering obligations.
• Payment Processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay and USDT TRC20, and to detect and prevent fraudulent transactions.
• Platform Delivery: To provide access to casino games, sports betting markets, live casino, Teen Patti, slots and all other pk38 gaming services.
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling and to implement deposit limits, loss limits, cooling-off periods and self-exclusion at your request or where required by our licensing obligations.
• Legal Compliance: To comply with obligations under our international gaming licence, anti-money laundering regulations, financial crime prevention requirements and any applicable court orders or regulatory directions.
• Customer Support: To respond to your queries, complaints and feedback submitted through the pk38 support channels.
• Marketing Communications: Where you have provided explicit consent, to send you information about pk38 promotions, bonuses and new gaming products. You may withdraw this consent at any time.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, security and user experience of the pk38 platform.

pk38 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where expressly permitted by applicable law.

4 Legal Basis for Processing

pk38 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform the contract between you and pk38 — that is, to operate your account, process transactions and deliver gaming services as described in our Terms and Conditions.
• Legal Obligation: Processing is necessary to comply with a legal or regulatory obligation, including anti-money laundering verification, age verification and licensing authority reporting requirements.
• Legitimate Interests: Processing is necessary for the legitimate interests of pk38, including fraud prevention, platform security, responsible gaming monitoring and improving our services, provided such interests are not overridden by your data protection rights.
• Consent: Where we rely on your consent as the legal basis — specifically for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

5 Data Sharing & Disclosure

pk38 does not sell, rent or trade your personal data to third parties for commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for each specific purpose:

• Payment Processors: Your financial data is shared with authorised payment processing partners, including mobile wallet operators (JazzCash, EasyPaisa, SadaPay) and banking institutions, solely to process your deposits and withdrawals.
• KYC Verification Providers: Identity documents and personal data submitted as part of the KYC process are shared with licensed third-party identity verification service providers who are contractually bound to process such data only for verification purposes.
• Licensing Authority: pk38's international gaming licence holder may require access to player data for regulatory audit, compliance reporting or investigation purposes. Such disclosures are mandatory under our licence conditions.
• Anti-Fraud Services: Certain technical and account data may be shared with fraud detection and prevention service providers to identify and mitigate fraudulent activity on the platform.
• Law Enforcement & Courts: pk38 will disclose personal data to law enforcement agencies, regulatory authorities or courts where required to do so by applicable law, court order or regulatory direction.
• Business Transfers: In the event of a merger, acquisition or sale of all or part of pk38's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections being applied.

All third parties with whom pk38 shares personal data are required to process that data securely, in accordance with applicable data protection standards, and only for the specified purpose. pk38 does not permit third parties to use your data for their own independent commercial purposes.

6 Payment Data

When you make a deposit or request a withdrawal on the pk38 platform, you provide payment details including mobile wallet account numbers (JazzCash, EasyPaisa, SadaPay), bank account details (HBL, UBL, Meezan Bank) or cryptocurrency wallet addresses (USDT TRC20). This payment data is processed as follows:

• Secure Transmission: All payment data is transmitted over encrypted SSL connections. pk38 does not store full bank account numbers or complete mobile wallet credentials on our servers.
• Transaction Records: pk38 retains transaction records — including deposit and withdrawal amounts, dates and payment method references — for the period required by our licensing authority and applicable financial record-keeping obligations.
• Anti-Money Laundering: Transaction data is analysed to detect patterns consistent with money laundering or other financial crime. Suspicious activity is reported to the relevant authorities in accordance with our licensing obligations.
• Payment Method Consistency: pk38 requires that withdrawals are processed to the same payment method used for deposits, as part of our anti-fraud and anti-money laundering controls.

7 KYC & Identity Verification

As a licensed gaming operator, pk38 is required to verify the identity and age of all players before processing withdrawals and, in certain cases, before allowing continued deposit activity. This Know Your Customer (KYC) process involves collection and processing of identity documents.

Documents submitted for KYC purposes — including CNIC scans, passport copies and proof of address — are handled as follows:

• Secure Storage: KYC documents are stored on encrypted, access-controlled servers. Access is restricted to authorised pk38 compliance personnel and our licensed verification partner.
• Purpose Limitation: KYC documents are used only for identity and age verification and to satisfy anti-money laundering obligations. They are not used for any other purpose.
• Retention Period: KYC documents are retained for a minimum of five years following the closure of your pk38 account, as required by standard gaming licence anti-money laundering obligations.
• Third-Party Verification: pk38 uses a licensed third-party identity verification provider to process KYC submissions. This provider is subject to equivalent data security and confidentiality obligations.

pk38 verifies that all players are aged 21 years or above as part of the KYC process. Accounts found to belong to persons under 21 will be immediately closed and any balances returned to the originating payment method after satisfactory verification of ownership.

8 Cookies & Tracking Technologies

The pk38 platform uses cookies and similar technologies to ensure the platform functions correctly, to maintain your session while you are logged in and to analyse how the platform is used so that we can improve it. pk38 does not use third-party advertising cookies or behavioural tracking technologies.

You can control and manage cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in and using the pk38 platform. Disabling analytics cookies will not affect your ability to use any pk38 features.

9 Data Retention

pk38 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting or reporting requirements imposed by our international gaming licence.

• Active Account Data: Retained for the lifetime of your pk38 account and for a minimum of five years following permanent account closure.
• Transaction Records: Financial transaction records are retained for a minimum of five years following the date of the transaction, in accordance with anti-money laundering record-keeping obligations.
• KYC Documents: Identity verification documents are retained for a minimum of five years following account closure.
• Support Communications: Customer support correspondence is retained for two years following the resolution of the relevant support query.
• Marketing Consent Records: Records of your marketing consent or withdrawal thereof are retained for the duration of your account and for two years after account closure.
• Technical Logs: Server logs and technical access records are retained for a maximum of twelve months.

Upon expiry of the applicable retention period, pk38 will securely delete or anonymise your personal data in a manner that prevents reconstruction of the original information.

10 Data Security

pk38 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• 256-Bit SSL Encryption: All data in transit between your device and the pk38 platform is protected using industry-standard 256-bit SSL/TLS encryption.
• Encrypted Data Storage: Sensitive personal data — including identity documents and financial records — is stored in encrypted form on access-controlled servers.
• Access Controls: Access to personal data is restricted to pk38 staff who require it to perform their specific job functions. All staff with data access undergo data security training.
• Intrusion Detection: pk38's platform infrastructure is monitored continuously for security threats, unusual access patterns and potential intrusion attempts.
• Regular Security Testing: pk38 conducts regular security assessments of the platform, including vulnerability scanning and penetration testing.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, pk38 will notify you without undue delay in accordance with applicable data protection requirements.

11 Your Data Rights

As a pk38 player, you have the following rights in relation to your personal data held by pk38. To exercise any of these rights, please contact the pk38 Data Privacy team using the details provided in Section 15. pk38 will respond to verified rights requests within 30 days.

• Right of Access: You have the right to request a copy of the personal data that pk38 holds about you, along with information about how that data is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update most account information directly through your pk38 account settings.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. This right is subject to pk38's legal and regulatory retention obligations, which may require us to retain certain data even after account closure.
• Right to Restriction: You have the right to request that pk38 restricts processing of your personal data in certain circumstances, such as while a dispute regarding accuracy is resolved.
• Right to Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, including processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

pk38 will not charge a fee for rights requests in ordinary circumstances. If a request is manifestly unfounded or excessive, pk38 reserves the right to charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

12 Children & Minors

The pk38 platform is strictly for adults aged 21 years and above. pk38 does not knowingly collect personal data from persons under the age of 21. Registration by any person under 21 is prohibited and constitutes a breach of pk38's Terms and Conditions.

If pk38 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the associated account, return any deposited funds to the originating payment method (subject to verification of ownership) and securely delete the relevant personal data, except where retention is required by law.

If you believe that a minor has registered an account on pk38, please contact our support team immediately. pk38 takes underage gaming extremely seriously and actively works to prevent it through mandatory age verification at the KYC stage.

13 Third-Party Links

The pk38 platform may contain links to third-party websites or resources for informational purposes. pk38 has no control over the content, privacy practices or data handling of such third-party websites and is not responsible for their privacy policies or practices.

This Privacy Policy applies solely to data collected by pk38 through the pk38.bio platform and associated communications. We recommend that you review the privacy policy of any third-party website you visit before submitting any personal data to that site.

14 Updates to This Policy

pk38 may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, legal obligations or regulatory requirements. When material changes are made, the updated Policy will be published on this page with a revised "Last Updated" date.

Where changes are significant — such as changes to the categories of data we collect, our data sharing arrangements or your rights — pk38 will notify registered players by email to the address associated with their account. Your continued use of the pk38 platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how pk38 handles your personal data. If you have any concerns about a change to this Policy, please contact the pk38 Data Privacy team before continuing to use the platform.

15 Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or to the handling of your personal data by pk38, please contact our Data Privacy team. We are committed to resolving all privacy-related queries promptly and transparently.

• Support Hours: 24 hours a day, 7 days a week, including public holidays in Pakistan.
• Response Time: General privacy queries are responded to within 5 business days. Formal data rights requests are handled within 30 calendar days of receipt.
• Language: All support communications are handled in English.