Privacy Policy — pkt365 Platform

This Privacy Policy ("Policy") describes how pkt365 ("Platform", "we", "us", "our"), accessible at https://pkt365.cam, collects, processes, stores, shares and protects personal data provided by or collected from users ("User", "Player", "you", "your") of the platform.

pkt365 is an English-language online betting and live casino information platform built for Pakistani users. In delivering our services — including sports betting, cricket markets, live casino, slots and related gaming products — we necessarily process certain personal data. This Policy sets out our data practices in full transparency.

This Policy is read alongside the pkt365 Terms & Conditions, which govern your use of the platform overall, and our Responsible Gambling guidance. Together, these documents form your complete agreement with pkt365.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can be used to identify a living individual, directly or indirectly. Examples include name, email address, CNIC number, IP address and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, deletion or any other handling of that data.
• "Data Controller" means pkt365 as the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of pkt365 under a contractual obligation.
• "Consent" means freely given, specific, informed and unambiguous agreement by the User to the processing of their personal data for a stated purpose.
• "KYC" (Know Your Customer) means the identity and age verification procedure applied to all registered users, particularly prior to enabling withdrawal functionality.
• "Cookie" means a small data file placed on your device by the platform for the purposes described in Section 9 of this Policy.
• "AML" means Anti-Money Laundering — the set of legal controls applied to detect and prevent the use of the platform to process funds derived from criminal activity.

pkt365 collects the following categories of personal data:

3.1 Registration & Identity Data

When you create a pkt365 account, we collect your full legal name, date of birth, email address, country and city of residence (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar), and a secure password. Pakistani users typically provide their CNIC number as a primary identifier during KYC.

3.2 Verification Documents

To comply with KYC and AML obligations, we may collect copies of government-issued identity documents — specifically a valid Pakistani CNIC or passport — alongside proof of address documents and selfie or liveness-check images. These are processed exclusively through our secure HTTPS verification portal.

3.3 Financial & Transaction Data

We collect details of deposits, withdrawals, wager histories and transaction amounts denominated in PKR or other applicable currencies. Payment method references — for example, bank transfer identifiers for HBL, UBL, Meezan Bank or Bank Alfalah, or digital wallet references for Easypaisa or JazzCash — may be collected for transaction verification purposes only.

3.4 Usage & Behavioural Data

We collect data on how you interact with the platform, including pages visited, games played, betting patterns, session duration, search queries, click events and feature usage. This data is used to improve the platform experience and to identify responsible-gambling risk indicators.

3.5 Technical & Device Data

Technical data includes your IP address, browser type and version, device type and operating system, screen resolution, referring URL, and cookies as described in Section 9 of this Policy.

3.6 Communications Data

If you contact our support team — via Live Chat, Help Center, or email at [email protected] — we retain records of those communications, including content, timestamps and support resolution outcomes.

We collect personal data through the following means:

• Directly from you: Registration forms, KYC document uploads, payment method details, support enquiries and voluntary communications.
• Automatically: Cookies, server logs, analytics tools and device fingerprinting technologies that operate when you visit or interact with the platform.
• From third parties: Identity verification service providers used during KYC; payment processors handling deposit and withdrawal instructions; fraud detection and AML screening services; and analytics platforms operating under data processor agreements.

pkt365 does not purchase personal data from data brokers or third-party marketing lists. We do not collect data from social media platforms without your direct consent.

pkt365 processes your personal data for the following purposes:

pkt365 processes personal data under the following legal grounds:

• Contract Performance: Processing is necessary to perform the contract between you and pkt365 — including account management, payment processing and service delivery.
• Legal Obligation: Certain processing is required to comply with applicable legal and regulatory obligations, including KYC identity verification and AML controls under the laws of the operator's licensing jurisdiction.
• Legitimate Interest: pkt365 processes certain data — such as fraud signals, platform analytics and responsible-gambling indicators — in pursuit of legitimate business interests, provided those interests do not override your fundamental privacy rights.
• Consent: Where processing is not covered by the above grounds — for example, opt-in marketing communications or non-essential cookies — we rely on your freely given, specific and informed consent. You may withdraw consent at any time without prejudice to the lawfulness of prior processing.

pkt365 does not sell your personal data. We do not share your data with third-party advertising networks or data brokers. Data is shared only in the following limited and controlled circumstances:

• KYC & Identity Verification Providers: Third-party services engaged to verify your identity documents and conduct liveness checks. All providers operate under strict data processor agreements.
• Payment Processors: Financial institutions and payment service providers involved in processing your deposits and withdrawals. Payment references — including those associated with Easypaisa, JazzCash, Raast, and bank transfers — are shared with processors only to the extent necessary to complete transactions.
• Fraud and AML Screening Services: Specialist compliance services used to screen accounts against sanctions lists, PEP databases and fraud indicators.
• Platform Technology Partners: Analytics, hosting and infrastructure providers that process usage and technical data on our behalf under data processor agreements.
• Legal and Regulatory Authorities: We may disclose personal data to competent regulatory, law enforcement or judicial authorities where required by applicable law or court order.
• Business Transfers: In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent data protection obligations being placed on the acquiring entity.

pkt365 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations.

• Active Account Data: Retained for the lifetime of your active account, plus a minimum post-closure retention period as required by AML and licensing obligations (typically five to seven years following account closure, depending on jurisdiction).
• KYC Verification Documents: Retained for the period required under applicable AML law — generally a minimum of five years from the date of the last transaction or account closure.
• Transaction Records: Retained for a minimum of five years to support audit, AML and dispute resolution requirements.
• Marketing Preferences and Consent Records: Retained for the duration of your consent and for a reasonable period thereafter to demonstrate compliance with consent obligations.
• Support Communications: Retained for a minimum of two years from the date of the last communication or resolution of a support ticket.

Once the applicable retention period expires, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

pkt365 uses cookies and similar tracking technologies to operate the platform, analyse usage patterns and, where you have consented, deliver relevant content. Below is a summary of the cookie categories we use:

You may manage, restrict or withdraw consent for non-essential cookies at any time through your browser settings or the platform's cookie preference controls. Disabling essential cookies will impair the functionality of the platform.

We do not use third-party advertising or retargeting cookies that track you across external websites.

pkt365 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include:

• 256-bit SSL/TLS encryption across all platform pages and data transmission channels
• Encrypted storage of sensitive data, including identity documents and financial records
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis
• Regular security audits and vulnerability assessments of platform infrastructure
• Secure KYC document upload through HTTPS-only verification portals
• Two-factor authentication (2FA) available for user accounts

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, pkt365 will notify affected users and relevant regulatory authorities in accordance with applicable data breach notification obligations.

Subject to applicable data protection law and any overriding legal obligations (such as AML retention requirements), you have the following rights in relation to your personal data held by pkt365:

To exercise any of the above rights, please contact us using the details in Section 16 of this Policy. We may ask you to verify your identity before processing a data rights request.

pkt365 is strictly an adults-only platform. We do not knowingly collect personal data from any individual under the age of 18, or the higher minimum age required by the operator's licensing jurisdiction.

Age verification is a mandatory step in the KYC process. Where we discover — through our verification processes or otherwise — that personal data has been provided by or on behalf of a minor, that data will be immediately deleted and the associated account closed.

pkt365 operates under applicable international jurisdiction. Your personal data may be transferred to and processed in countries outside Pakistan — including countries where pkt365's hosting infrastructure, KYC providers or payment processors are located. These countries may have different data protection standards to those in your home jurisdiction.

Where personal data is transferred internationally, pkt365 ensures that appropriate safeguards are in place — including contractual data protection clauses and, where applicable, adequacy decisions — to protect your data to a standard equivalent to the requirements of applicable data protection law.

pkt365 serves a significant number of users based in Pakistan — across cities including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. We take our obligations to these users seriously and have written this Policy to be clear and accessible to a Pakistani English-speaking audience.

Pakistan's primary data protection framework includes the Prevention of Electronic Crimes Act, 2016 (PECA) and emerging data protection regulations. pkt365 is not a Pakistani-registered entity and does not claim to operate under a Pakistan-specific data protection licence. However, we apply internationally recognised privacy standards to all user data, regardless of the user's country of origin.

References to payment methods familiar to Pakistani users — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — appear in this Policy in the context of transaction processing only. None of these institutions endorse, regulate or are affiliated with pkt365 or its data practices. Data shared with payment processors is strictly limited to what is required to execute the relevant transaction.

pkt365 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data practices, or the services we offer. The "Last Updated" date at the top of this page will be revised each time a change is made.

Where changes are material — for example, where we introduce a new processing purpose or a new category of data sharing — we will provide reasonable notice through an on-platform notification or email communication to your registered address. However, it remains your responsibility to review this Policy periodically.

Your continued use of pkt365 following any update to this Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns or requests relating to this Privacy Policy or the way pkt365 handles your personal data, please contact our Data Protection team using the details below. We aim to respond to all data-related queries within 30 days of receipt of a verified request.

Complaints

If you are not satisfied with our response to a data privacy concern, you have the right to lodge a complaint with the relevant supervisory authority in the operator's licensing jurisdiction. Details of the applicable supervisory authority are available in the operator's licensing documentation.