Privacy Policy — 398pkr

398pkr ("398pkr", "we", "us", "our") is committed to protecting the privacy and security of the personal information entrusted to us by users ("you", "User", "Player") of the 398pkr platform, accessible at https://398pkr.cam and any associated mobile interfaces (collectively, the "Platform").

This Privacy Policy describes, in clear and accessible terms, the categories of personal data we collect, the purposes for which that data is processed, the lawful basis on which we rely for such processing, the parties with whom data may be shared, the security measures we employ, and the rights available to you as a data subject.

This Privacy Policy forms part of the contractual relationship between you and 398pkr. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or an online identifier.
• "Processing" means any operation or set of operations performed on personal data, including collection, storage, use, transmission, deletion and any other form of handling.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. In the context of this Policy, the Data Controller is 398pkr.
• "Data Processor" means a natural or legal person that processes personal data on behalf of the Data Controller.
• "KYC" means Know Your Customer — the identity, age and source-of-funds verification process required before account activation, withdrawals or as otherwise prompted by compliance requirements.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, track usage and support analytics.
• "Consent" means freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of their personal data for one or more specific purposes.

398pkr collects personal data in the following categories, depending on your interaction with the Platform:

3.1 Identity & Registration Data

Collected at the point of account registration and used for identity verification, account management and regulatory compliance.

3.2 Contact Data

Used to communicate with you about your account, support requests, security alerts and — where consent has been given — promotional communications. City references (such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar) may be recorded where provided voluntarily.

3.3 KYC & Verification Documents

Collected as required to satisfy identity verification, age verification, anti-money laundering (AML) and responsible gambling obligations.

3.4 Financial & Transaction Data

Records of deposits, withdrawals and wagers placed through the Platform. Payment method references — including references to services such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah where selected as a cashier method — are recorded for transaction processing and compliance purposes only. Inclusion of these references does not constitute an endorsement or partnership with those providers.

3.5 Technical & Device Data

Collected automatically when you access the Platform to ensure security, detect fraud, verify jurisdiction eligibility and optimise Platform performance.

3.6 Behavioural & Usage Data

Used for responsible gambling monitoring, product improvement, fraud detection and, where applicable, personalisation of the player experience.

3.7 Communications Data

Retained for quality assurance, dispute resolution, training and compliance audit purposes.

398pkr collects personal data through the following means:

• Directly from you: when you register an account, complete KYC, make a deposit or withdrawal, contact support, or respond to surveys or promotions.
• Automatically: via cookies, web beacons and server logs when you browse or interact with the Platform.
• From third-party service providers: including KYC and identity verification providers, payment processors and fraud-detection partners who may share data with us in connection with your account activity.
• From publicly available sources: where permitted by applicable law and only for the purpose of verifying the accuracy of information you have provided or as required for compliance purposes.

398pkr processes your personal data on one or more of the following lawful bases:

• Contractual Necessity: processing that is required to perform the contract between you and 398pkr, including account registration, deposits, withdrawals and the provision of gaming services.
• Legal Obligation: processing required to comply with applicable laws and regulations, including AML obligations, KYC requirements and responsible gambling regulatory requirements.
• Legitimate Interests: processing that is necessary for 398pkr's legitimate business interests, including fraud prevention, platform security, product improvement and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: where you have given explicit consent for a specific processing purpose, such as receiving marketing communications. You may withdraw consent at any time by contacting us or using the unsubscribe mechanism in our communications.

398pkr processes personal data for the following specific purposes:

• Account creation and management: registering and maintaining your 398pkr account, including authentication and access control.
• Identity and age verification (KYC): confirming that you meet the minimum age requirement and satisfy our Know Your Customer obligations before permitting deposits, withdrawals and wagering.
• Transaction processing: facilitating deposits and withdrawals in PKR and other supported currencies through available payment channels.
• Responsible gambling monitoring: tracking wagering patterns, limit usage and self-exclusion status to fulfil our responsible gambling obligations and protect vulnerable players.
• Fraud prevention and security: detecting and preventing fraudulent, money-laundering and other unauthorised activity on the Platform.
• Customer support: responding to your queries, complaints and account-related requests.
• Platform improvement and analytics: understanding how the Platform is used to improve performance, usability and product features.
• Legal and regulatory compliance: meeting obligations under applicable laws including AML regulations, tax reporting requirements and any instructions from competent authorities.
• Marketing communications: sending promotional offers, bonuses and updates where you have provided consent and have not subsequently withdrawn it.

398pkr does not sell, rent or trade your personal data. We may share your personal data with the following categories of third parties only where necessary and in accordance with applicable data protection requirements:

• KYC and Identity Verification Providers: specialist third-party services that verify identity documents, age confirmation and AML screening.
• Payment Processors: entities that process deposit and withdrawal transactions on our behalf. Only the data necessary to complete the transaction is shared.
• Fraud Detection and Security Partners: technology providers that assist in identifying and preventing fraudulent activity, multi-accounting and money laundering.
• IT Infrastructure and Hosting Providers: cloud services and hosting providers that store and process Platform data on our behalf under appropriate data processing agreements.
• Analytics Providers: services that help us analyse Platform usage patterns to improve performance and user experience.
• Legal and Regulatory Authorities: competent courts, regulatory bodies, law enforcement agencies or other governmental bodies where disclosure is required by law, court order or in connection with legal proceedings.
• Professional Advisors: lawyers, auditors, accountants and insurers where necessary in connection with the operation of 398pkr's business.

The operation of an online gambling platform necessitates the use of technology infrastructure and service providers that may be located in jurisdictions outside Pakistan. Consequently, your personal data may be transferred to and processed in countries other than Pakistan.

Where such transfers occur, 398pkr takes steps to ensure that appropriate safeguards are in place to protect your personal data, including the use of standard contractual clauses, adequacy decisions or other recognised transfer mechanisms where applicable under relevant data protection frameworks.

By using the 398pkr Platform, you acknowledge and accept that your personal data may be processed in jurisdictions with different data protection standards than those that apply in Pakistan.

398pkr retains personal data for as long as is reasonably necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. In particular:

• Account Data: retained for the duration of your active account plus such additional period as required by applicable AML, gambling regulatory and tax laws following account closure.
• KYC Documentation: retained in accordance with the retention periods specified under applicable AML legislation in the relevant licence jurisdiction, typically a minimum of five years from the end of the business relationship.
• Transaction Records: retained for a minimum period as required by applicable financial regulations, typically five to seven years.
• Support Communications: retained for a period appropriate to the nature of the interaction, generally up to five years, to support dispute resolution and quality assurance.
• Marketing Consent Records: retained for the duration of the consent period plus such additional period as required to demonstrate compliance in the event of a complaint or regulatory inquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

398pkr implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the Platform.
• Access controls restricting internal access to personal data to authorised personnel on a need-to-know basis.
• Secure, encrypted storage for sensitive personal and financial data.
• Regular security assessments and vulnerability testing of Platform infrastructure.
• Two-factor authentication (2FA) options available to all account holders for enhanced account security.
• Incident response procedures for the detection, reporting and management of personal data breaches.

398pkr uses cookies and similar technologies (including web beacons and local storage) to provide and improve the Platform, enable certain functionality and analyse usage patterns. The following categories of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies and security tokens. They cannot be disabled without affecting core Platform functionality.
• Functional Cookies: Remember your preferences, language settings and authentication status to provide a personalised experience between sessions.
• Analytics Cookies: Collect aggregated, anonymised information about how users navigate the Platform to help us improve structure, content and performance.
• Marketing Cookies: Used — where consent has been given — to track engagement with promotional content and measure the effectiveness of marketing campaigns.

You can manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may impair Platform functionality. Specific cookie consent preferences can be managed via the cookie settings panel accessible on the Platform.

Subject to applicable law and any overriding legal obligations on 398pkr (including AML, KYC and regulatory retention requirements), you hold the following rights in respect of your personal data:

To exercise any of the above rights, please contact the 398pkr Data Protection team at the details provided in Section 16. We will respond to all valid requests within the timeframe required by applicable law. We may need to verify your identity before processing a request.

398pkr is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 18, or the higher minimum age required under the applicable licence jurisdiction. Our registration process includes age verification steps, and KYC procedures are employed to confirm that account holders meet the minimum age requirement.

If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered an account with 398pkr, please contact us immediately at the details provided in Section 16.

Where you have given consent, 398pkr may send you promotional communications regarding new features, bonuses, sports betting opportunities and other offers. All marketing communications will be sent in English.

You may withdraw your consent to marketing communications at any time by:

• Using the unsubscribe link provided in any marketing email;
• Updating your communication preferences within your account settings; or
• Contacting our support team directly at the address provided in Section 16.

Withdrawal of marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal, nor does it prevent 398pkr from sending you essential service communications relating to your account (such as security alerts, KYC requests or withdrawal confirmations), which are sent on the basis of contractual necessity rather than consent.

398pkr reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws or Platform functionality. When material changes are made, the Effective Date at the top of this document will be updated.

Where required by applicable law, or where changes are material to your rights, we will provide advance notice by email to your registered address or via a prominent notice on the Platform prior to the changes taking effect.

Continued use of the 398pkr Platform following publication of an updated Privacy Policy constitutes your acknowledgement of, and — where applicable — consent to, the updated terms. We recommend that you review this Privacy Policy periodically. If you do not accept the updated Policy, you should cease using the Platform and contact support to arrange account closure.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern about how your personal data has been handled, please contact the 398pkr Data Protection team:

Please note that we may require you to verify your identity before processing any data subject request. This is to protect your personal data and prevent unauthorised access to it by third parties.