Privacy Policy —
pkr8 User Data Protection

This Privacy Policy ("Policy") describes how pkr8 ("we", "us", "our") collects, uses, stores, shares and protects the personal data of users ("you", "your") who access or use the pkr8 platform at https://pkr8.cam and any associated digital properties (collectively, the "Platform"). pkr8 is an English-language online sports betting and casino information platform designed primarily for Pakistani users.

We are committed to handling your personal data responsibly, transparently and in accordance with applicable data protection laws. This Policy is intended to give you a clear understanding of your privacy rights and our data practices so that you can make informed decisions when using the Platform.

By registering an account, accessing the Platform or otherwise providing your personal data to pkr8, you confirm that you have read and understood this Policy. If you do not agree with the practices described in this Policy, you should discontinue your use of the Platform and may request account closure in accordance with our Terms & Conditions.

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier or other factors specific to that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, pkr8 is the Data Controller.
• "Data Processor" means a natural or legal person that processes Personal Data on behalf of the Data Controller under written instructions.
• "Cookies" means small text files stored on your device by a web browser at the instruction of a website, used to retain information between sessions.
• "KYC" means Know Your Customer — the identity and age verification process required to confirm a user's identity before certain account functions are enabled.
• "Special Category Data" means Personal Data that is particularly sensitive by nature, including data relating to health, biometrics or criminal convictions, as defined under applicable data protection law.
• "Platform" has the meaning given in the Introduction above.

pkr8 operates the Platform at https://pkr8.cam and acts as the Data Controller in respect of Personal Data collected through the Platform. pkr8 does not hold a gambling licence issued by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA) or the State Bank of Pakistan (SBP). The Platform's data processing activities are conducted in accordance with the laws of the jurisdiction in which pkr8 holds its primary operating licence.

Queries regarding the processing of your Personal Data, requests to exercise your data rights, or complaints relating to this Policy should be directed to our support team. Contact details are provided in Section 17 of this Policy.

pkr8 collects the following categories of Personal Data, depending on how you use the Platform:

pkr8 does not intentionally collect Special Category Data. In the event that such data is incidentally disclosed by a User (for example, in a support communication), it will not be used for any purpose other than addressing the immediate matter and will be deleted as soon as practicable.

pkr8 collects Personal Data through the following means:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey or participate in a promotion.
• Automated technologies: Data collected automatically when you access the Platform, including cookies, web beacons, server logs and similar tracking technologies. See Section 11 for our Cookie Policy.
• Third-party sources: Data received from identity verification providers, fraud prevention agencies, payment processors, and (where lawful) publicly available sources, to supplement or verify information you have provided.
• Responsible gambling monitoring: Behavioural data generated by your platform usage, which pkr8 analyses to identify indicators of problem gambling in accordance with its responsible gambling obligations.

pkr8 processes Personal Data on the following legal bases:

• Performance of a contract: Processing necessary to provide the services described in our Terms & Conditions, including account management, payment processing and customer support.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) legislation, KYC requirements and regulatory reporting obligations imposed by the jurisdiction in which pkr8 is licensed.
• Legitimate interests: Processing necessary for pkr8's legitimate business interests, including fraud detection and prevention, platform security, responsible gambling monitoring, and improving Platform performance, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, informed and unambiguous consent, including the use of non-essential cookies and the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

pkr8 processes your Personal Data for the following purposes:

1. Account creation and management: To register your account, maintain your profile and provide access to platform features.
2. Identity verification (KYC): To verify your age, identity and address as required by anti-money laundering and responsible gambling regulations.
3. Payment processing: To process deposits and withdrawals in PKR and other supported currencies, and to record your transaction history.
4. Fraud and money laundering prevention: To detect, investigate and prevent fraudulent activity, money laundering, terrorist financing and other unlawful conduct.
5. Responsible gambling monitoring: To identify behavioural patterns that may indicate problem gambling, to apply account restrictions where requested or required, and to communicate responsible gambling information.
6. Customer support: To respond to your enquiries, resolve complaints and provide assistance with account issues.
7. Marketing communications: To send you promotional offers, bonuses and platform updates, subject to your marketing preferences and applicable consent requirements. You may opt out of marketing communications at any time.
8. Platform improvement: To analyse usage patterns, test new features, fix errors and improve the overall user experience.
9. Legal compliance: To comply with applicable laws, respond to regulatory enquiries, enforce our Terms & Conditions and defend or bring legal claims.

pkr8 does not sell your Personal Data to third parties for their own marketing purposes. We may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment processors and financial institutions: To process your deposits and withdrawals. References to payment services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on the Platform are for contextual reference only; any actual payment data sharing is governed by the relevant processor's agreement with pkr8.
• KYC and identity verification providers: To verify your identity, age and address documents in accordance with our KYC obligations.
• Fraud prevention and anti-money laundering agencies: To screen your account against relevant watchlists, sanctions lists and fraud databases.
• Responsible gambling support services: In limited circumstances where an account is flagged for self-exclusion or where intervention is required to protect a vulnerable user.
• Technology service providers: Including cloud hosting, analytics and platform infrastructure providers who process Personal Data on pkr8's behalf under written Data Processing Agreements.
• Regulatory and law enforcement authorities: Where required by law, court order or regulatory direction, or where pkr8 reasonably believes disclosure is necessary to protect its rights, the rights of third parties or public safety.
• Business successors: In the event of a merger, acquisition, restructuring or sale of all or part of pkr8's business, Personal Data may be transferred to the acquiring entity, subject to appropriate confidentiality undertakings.

pkr8 may transfer your Personal Data to countries outside the country in which you are located, including to countries that may not provide the same level of data protection as your home jurisdiction. Where such transfers occur, pkr8 implements appropriate safeguards, which may include Standard Contractual Clauses, adequacy decisions or other transfer mechanisms recognised under applicable data protection law.

Users based in Pakistan should be aware that there is no specific data protection legislation in Pakistan currently equivalent to international data protection standards such as the European Union's General Data Protection Regulation (GDPR). pkr8 nevertheless applies its data protection practices as described in this Policy to all users regardless of location.

pkr8 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years following the date of the transaction, or longer where required by applicable regulations.
• KYC documentation: Retained for a minimum of five (5) years following the end of the business relationship, or longer where required by law or ongoing regulatory proceedings.
• Support communications: Retained for up to three (3) years following the closure of the support case, unless relevant to a live legal matter.
• Marketing preference data: Retained until you withdraw consent or request deletion, subject to legal retention obligations.
• Technical and usage data (logs): Retained for up to twelve (12) months, except where longer retention is required for fraud investigation or legal proceedings.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be attributed to you as an individual.

11.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management, security tokens and load-balancing cookies. They cannot be disabled without affecting Platform functionality.
• Analytical / Performance Cookies: Used with your consent to collect aggregated data about how users interact with the Platform, which pages are visited most frequently and where errors occur. This data helps us improve Platform performance.
• Functionality Cookies: Used to remember your preferences such as language, currency display (PKR) and responsible gambling limit settings, so you do not need to re-enter them on each visit.
• Marketing / Targeting Cookies: Used, subject to your consent, to deliver relevant promotional content on the Platform and on third-party channels. You may opt out of these at any time.

11.2 Managing Cookies

You can manage your cookie preferences through your account settings on the Platform or through your browser's built-in privacy controls. Most browsers allow you to block or delete cookies. Note that blocking strictly necessary cookies will impair Platform functionality. Withdrawing consent for analytical or marketing cookies will not affect any prior processing carried out on the basis of consent.

pkr8 implements appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform;
• Encryption of Personal Data at rest using industry-standard algorithms;
• Role-based access controls, ensuring that only authorised personnel with a legitimate need can access Personal Data;
• Regular security testing, including vulnerability assessments and penetration testing;
• Incident response procedures to detect, contain and report Personal Data breaches in a timely manner;
• Staff training on data protection obligations and security best practices.

While pkr8 takes reasonable steps to protect your Personal Data, no method of electronic transmission or storage is 100% secure. Users are encouraged to use strong, unique passwords for their accounts and to contact support immediately if they suspect unauthorised access to their account.

Subject to applicable law, you have the following rights in relation to your Personal Data held by pkr8:

• Right of Access: You have the right to request a copy of the Personal Data pkr8 holds about you and information about how it is processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent. This right is subject to legal retention obligations — for example, AML record-keeping requirements may prevent deletion of certain financial records.
• Right to Restriction of Processing: You may request that pkr8 restricts the processing of your Personal Data in certain circumstances, such as when the accuracy of the data is contested.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used and machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling, where your individual circumstances justify it. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our support team using the details in Section 17. We will respond to your request within a reasonable period and in any event within any timeframe required by applicable law. We may need to verify your identity before processing your request.

The Platform is strictly for adults aged 18 or older (or the higher minimum age required by the operator's licence jurisdiction). pkr8 does not knowingly collect Personal Data from individuals under the age of 18. Age verification is a mandatory part of the KYC process, and accounts will be suspended pending age verification if there is any doubt about a User's eligibility.

If a parent or guardian believes that their child has provided Personal Data to pkr8, they should contact us immediately using the details in Section 17. We will take prompt steps to investigate and, where confirmed, to delete the relevant Personal Data and close the associated account.

pkr8 is designed for Pakistani users and processes Personal Data of individuals located in Pakistan. Pakistan does not currently have a comprehensive general data protection statute equivalent to international frameworks such as the EU GDPR. The Prevention of Electronic Crimes Act 2016 (PECA) and the Pakistan Telecommunication (Re-Organisation) Act 1996 contain certain provisions relevant to data and cybersecurity, but these do not constitute a full data protection regime.

pkr8 applies the data protection principles described in this Policy to all users, including those in Pakistan, and commits to the following in relation to Pakistani user data:

• We do not share Pakistani user data with the Government of Pakistan, PTA, State Bank of Pakistan or any Pakistani financial institution for marketing or profiling purposes;
• References to payment services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on the Platform are contextual references only — sharing of payment data with any payment processor is governed by the processor's own privacy policy and applicable agreements;
• We do not claim that this Policy makes online gambling lawful in Pakistan. Users in Pakistan are solely responsible for ensuring their use of the Platform complies with applicable Pakistani law, including the Prevention of Gambling Act, 1977.

pkr8 reserves the right to amend or update this Privacy Policy at any time. Where changes are material — for example, where we introduce a new purpose for processing or add a new category of data — we will provide reasonable advance notice by email to the address associated with your account or by prominent notice on the Platform, prior to the changes taking effect.

The "Last Updated" date at the top of this page indicates when this Policy was most recently revised. We encourage you to review this page periodically. Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you should discontinue use of the Platform.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way pkr8 processes your Personal Data, or if you wish to exercise any of your rights under Section 13, please contact our support team. Our support agents are available 24 hours a day, 7 days a week, including during Pakistan Standard Time (PKT) peak hours.

Please include "Privacy Request" or "Data Enquiry" in the subject line of your email so that we can route your message to the appropriate team. We will acknowledge your request promptly and aim to provide a substantive response within 30 calendar days, or within any shorter period required by applicable law.

For matters specifically relating to responsible gambling and self-exclusion, please visit our Responsible Gambling page. For full platform usage terms, please refer to our Terms & Conditions.