pk86 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1.1 This Privacy Policy ("Policy") is issued by pk86 ("pk86," "we," "us," "our") and governs the collection, processing, storage, use, and disclosure of personal data relating to individuals ("you," "your," "User") who access or use the pk86 online casino and sports betting platform, including the website at pk86.vu and all associated services and features ("Platform").

1.2 pk86 is a licensed online gaming operator. Our international gaming license imposes specific obligations relating to the collection and processing of personal data from Users, including mandatory Know Your Customer (KYC) identity verification, anti-money laundering (AML) record-keeping, and responsible gaming monitoring. This Policy explains how we fulfil those obligations and how we handle personal data more broadly across all Platform activities.

1.3 pk86's Platform is designed for and marketed primarily to adult users in Pakistan. Where this Policy references "Pakistani users" or "Pakistani players," it refers to individuals located in or ordinarily resident in Pakistan who access the Platform. The Platform operates in English, and this Policy is accordingly published in English as the binding version.

1.4 By registering a pk86 account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not accept this Policy, you must not create an account or use the Platform.

1.5 This Policy should be read alongside pk86's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2.1 For the purposes of applicable data protection law, the data controller in respect of personal data processed in connection with the pk86 Platform is the company operating pk86 under its international gaming license.

2.2 The data controller is responsible for determining the purposes and means of processing your personal data. All requests relating to your personal data — including requests to access, correct, delete, or restrict processing — should be directed to pk86's designated data contact at [email protected], clearly marked "Data Privacy Request" in the subject line.

2.3 Where pk86 engages third-party service providers (for example, payment processors, game software providers, or fraud prevention services) who process personal data on pk86's behalf, those providers act as data processors under written agreements that impose obligations consistent with applicable data protection requirements. pk86 remains accountable as data controller for data processed in this manner.

3.1 pk86 collects the following categories of personal data in connection with the operation of the Platform:

3.2 pk86 does not collect or store full payment card numbers. All payment instrument data is processed via PCI-DSS compliant payment processors. pk86 retains only the minimum reference data necessary to identify and reconcile transactions.

3.3 Special category data (including health data, religious beliefs, or political opinions) is not intentionally collected by pk86. Where a User voluntarily discloses special category data — for example, in the context of a responsible gaming self-disclosure — pk86 will handle such data with heightened care and will use it only for the specific purpose for which it was disclosed.

4.1 pk86 collects personal data through the following mechanisms:

• Direct collection: Data you provide voluntarily during registration, KYC submission, payment processing, support contact, or promotional participation.
• Automated collection: Technical and usage data collected automatically when you access or use the Platform, including through cookies, log files, and session tracking technologies (see Section 10).
• Third-party sources: Identity verification data from KYC verification service providers; fraud risk scoring data from fraud prevention services; payment transaction data from payment processors including JazzCash and EasyPaisa network providers.
• Publicly available sources: In limited circumstances, pk86 may verify identity information against publicly available government records or sanctions screening databases as required by AML obligations.

4.2 pk86 does not purchase personal data from data brokers or unrelated third parties for marketing purposes.

5.1 pk86 processes personal data on the following legal bases, depending on the specific processing activity:

• Contract performance: Processing necessary to enter into and perform the agreement with you under pk86's Terms and Conditions — including account creation, processing deposits and withdrawals, game play, and providing customer support.
• Legal obligation: Processing required to comply with pk86's legal and regulatory obligations under its international gaming license — including mandatory KYC identity and age verification, AML transaction monitoring and reporting, and responsible gaming record-keeping.
• Legitimate interests: Processing for pk86's legitimate business interests where those interests are not overridden by your privacy rights — including fraud prevention, platform security monitoring, product improvement analytics, and internal business reporting.
• Consent: Processing based on your explicit consent for specific purposes — primarily direct marketing communications. Where consent is the legal basis, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6.1 pk86 uses the personal data described in Section 3 for the following purposes:

• Account management: Creating and maintaining your pk86 account, processing login authentication, managing account security settings including two-factor authentication.
• Identity and age verification (KYC): Verifying that you meet the 21+ age requirement and that your identity matches the registration details provided, as required by our gaming license.
• Payment processing: Processing deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK; processing withdrawal requests; reconciling transaction records; investigating payment disputes.
• Game provision: Delivering casino games, sportsbook markets (including PSL cricket and other sports), live dealer games, and other Platform features; recording game outcomes and bet histories for settlement and dispute resolution purposes.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling behaviour; enforcing deposit limits, loss limits, cooling-off periods, and self-exclusion requirements set by Users; maintaining responsible gaming records as required by the gaming license.
• Anti-money laundering compliance: Monitoring transactions for AML indicators; conducting enhanced due diligence where required; reporting to competent authorities where legally obligated.
• Fraud prevention and security: Detecting and preventing fraudulent account activity, multi-accounting, payment fraud, bonus abuse, and unauthorised access; maintaining platform security.
• Customer support: Responding to your support queries, resolving complaints, processing account closure requests, and maintaining support interaction records.
• Legal compliance: Complying with requests from competent regulatory authorities, courts, or law enforcement agencies where pk86 is legally obligated to do so.
• Marketing (consent-based): Sending promotional offers, bonus notifications, and other marketing communications via email or SMS, where you have opted in to receive such communications.
• Platform improvement: Analysing aggregated usage data to improve Platform performance, game selection, user experience, and responsible gaming tools.

6.2 pk86 does not use personal data for automated individual decision-making that produces legal or similarly significant effects without human oversight, except where required by AML compliance obligations and subject to appropriate safeguards.

7.1 pk86 shares personal data with third parties only in the circumstances described below. pk86 does not sell personal data to third parties for their independent commercial use.

7.2 All third-party data processors engaged by pk86 are subject to written data processing agreements that require them to implement appropriate technical and organisational security measures and to process personal data only in accordance with pk86's documented instructions.

8.1 pk86 retains personal data for only as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of your account plus a minimum of five (5) years following account closure, as required by AML and gaming license record-keeping obligations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AML regulatory requirements.
• KYC documents (CNIC copies, photographs): Retained for the duration of your account plus five (5) years from account closure.
• Gameplay and bet history: Retained for a minimum of five (5) years for regulatory compliance purposes; aggregated statistical data may be retained indefinitely in anonymised form.
• Support communications: Retained for three (3) years from the date of the last communication, to support dispute resolution and regulatory audit requirements.
• Marketing data (where consent provided): Retained until you withdraw consent or for a maximum of three (3) years from the date of last Platform activity, whichever is earlier.

8.2 Upon expiry of the applicable retention period, pk86 will securely delete or anonymise personal data in accordance with established data destruction procedures. Personal data that has been anonymised and can no longer be linked to an identifiable individual is not subject to the retention periods above and may be retained for analytical purposes.

9.1 pk86 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser or device and the pk86 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to login, registration, deposits, and all other Platform interactions.
• Encryption at rest: Sensitive personal data — including KYC documents and financial records — is stored using encryption at rest on pk86's infrastructure.
• Password security: User passwords are stored using a one-way cryptographic hashing algorithm with per-user salt values. pk86 staff cannot retrieve your plaintext password.
• Two-factor authentication (2FA): pk86 offers 2FA for account login, strongly recommended for all Users. 2FA adds a second verification layer that significantly reduces the risk of unauthorised account access.
• Access controls: Internal access to User personal data is restricted on a strict need-to-know basis. Staff access to sensitive data is logged and audited.
• Regular security testing: pk86 conducts regular vulnerability assessments and penetration testing of its Platform infrastructure.
• Incident response: pk86 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to Users, pk86 will notify affected Users and relevant authorities in accordance with applicable obligations.

9.2 No security system is impenetrable. While pk86 takes all reasonable steps to protect your personal data, we cannot guarantee absolute security. You also bear responsibility for protecting your account credentials. Never share your password with anyone, and contact pk86 support immediately if you suspect your account has been compromised.

10.1 pk86 uses cookies and similar tracking technologies on the Platform to enable essential functionality, improve performance, and (where you have consented) to support analytics. The following cookie categories are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in, security cookies, and cookies that maintain your stated preferences (such as language settings). These cookies cannot be disabled without disabling essential Platform functionality.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how Users navigate the Platform — which pages are visited, how long sessions last, and where Users encounter errors. This data is used solely to improve the Platform. These cookies are only set with your consent.
• Functional cookies: Used to remember your Platform preferences — such as preferred games or display settings — to improve your experience. Set only with your consent.

10.2 pk86 does not use third-party advertising or retargeting cookies. pk86 does not share cookie data with unrelated advertising networks.

10.3 You can manage your cookie preferences at any time from the cookie settings panel accessible in the Platform footer. You can also manage cookies through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use Platform features.

10.4 In addition to cookies, pk86 may use server-side log files and session tokens for security monitoring and fraud detection. These are operational necessities and are not optional.

11.1 Subject to applicable law and certain regulatory restrictions, you have the following rights in respect of your personal data held by pk86. To exercise any of these rights, please contact [email protected] with the subject line "Data Rights Request," providing your registered email address or mobile number for verification purposes.

• Right of access: You have the right to request a copy of the personal data pk86 holds about you, together with information about how it is being processed.
• Right to rectification: You have the right to request correction of inaccurate personal data. Note that corrections to identity data may require re-submission of KYC documents.
• Right to erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to limitations where pk86 is required to retain data by law — including the AML retention obligations described in Section 8. We will inform you of any applicable limitations when responding to erasure requests.
• Right to restriction of processing: You may request that pk86 restrict processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing of your personal data where pk86 relies on legitimate interests as the legal basis. pk86 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11.2 pk86 will respond to all verifiable data rights requests within thirty (30) days of receipt. Where a request is complex or pk86 receives a high volume of requests, this period may be extended by a further two months, of which you will be notified.

11.3 pk86 will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

11.4 Certain rights are subject to restrictions where pk86 is required to retain or continue processing data under its gaming license or AML obligations. Where a restriction applies, pk86 will explain the basis for the restriction in its response to your request.

12.1 The pk86 Platform is strictly intended for adults aged twenty-one (21) years or older. pk86 does not knowingly collect personal data from any person under the age of 21. The collection of data from minors is not only contrary to pk86's Terms and Conditions but is also prohibited under our gaming license.

12.2 pk86 applies mandatory age verification (KYC) to all accounts prior to processing any withdrawal. Where pk86 identifies or reasonably suspects that an Account holder is under 21 years of age, the Account will be immediately suspended and all personal data associated with the Account will be reviewed. If underage use is confirmed, the Account will be permanently closed and any personal data collected will be deleted save to the extent required for regulatory reporting and compliance purposes.

12.3 Parents and guardians are responsible for preventing minors in their care from accessing online gambling platforms. pk86 recommends the use of internet filtering tools to restrict minors' access to online gambling content. If you believe a minor in your care has registered a pk86 account, please contact [email protected] immediately.

13.1 pk86 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, PSL cricket betting markets, seasonal promotions, and other pk86 offers — but only where you have explicitly opted in to receive such communications during registration or through your account settings.

13.2 Marketing communications from pk86 will always identify pk86 as the sender and will always include a clear and simple mechanism to unsubscribe or opt out. You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email;
• Replying "STOP" to any marketing SMS;
• Updating your communication preferences in your pk86 Account settings; or
• Contacting pk86 support at [email protected] with the subject line "Marketing Opt-Out."

13.3 Opting out of marketing communications will not affect your ability to use any pk86 Platform feature, nor will it affect transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, or important policy update notices — which pk86 may send regardless of marketing preferences.

13.4 pk86 does not share your contact details with unrelated third parties for their own marketing purposes. Any promotional communications you receive from pk86 originate exclusively from pk86 — not from partners or advertisers using pk86-sourced data.

14.1 pk86 operates as an international gaming platform. As a result, personal data collected from Pakistani users may be transferred to, stored on, or processed by systems located outside of Pakistan — including in the jurisdiction where pk86 holds its gaming license, and in jurisdictions where pk86's cloud infrastructure and third-party service providers operate.

14.2 Where personal data is transferred internationally, pk86 takes steps to ensure that appropriate safeguards are in place to protect your data at a standard consistent with this Policy. These safeguards may include:

• Contractual clauses requiring the recipient to protect personal data to a standard equivalent to that required by this Policy;
• Transfer to jurisdictions recognised as providing an adequate level of data protection;
• Implementation of technical security measures (encryption, access controls) that apply irrespective of the data's physical location.

14.3 By using the pk86 Platform and accepting this Policy, you acknowledge and consent to the transfer of your personal data to other jurisdictions as described in this Section, where necessary for the provision of pk86's services and compliance with regulatory obligations.

15.1 pk86 reserves the right to update or amend this Privacy Policy at any time. Updates may be made to reflect changes in applicable law, regulatory requirements, pk86's data processing practices, or new Platform features. The version date displayed at the top of this Policy reflects the date of the most recent update.

15.2 Where an update materially affects your rights or the way in which pk86 processes your personal data, pk86 will notify registered Account holders by email to their registered address, and will display a prominent notice on the Platform, prior to the updated Policy taking effect. The notice period will be at least fourteen (14) days unless a shorter period is required to comply with a regulatory obligation.

15.3 Continued use of the pk86 Platform following the effective date of an updated Privacy Policy constitutes acceptance of the updated terms. If you do not accept an update, you should exercise your right to close your Account and request deletion of your personal data in accordance with Section 11 before the updated Policy takes effect.

15.4 The current, binding version of this Privacy Policy is always the version published on the pk86 Platform. Previous versions are available upon request from [email protected].

16.1 For all privacy-related enquiries, data rights requests, or complaints regarding pk86's handling of your personal data, please contact pk86's data privacy team through the following channel:

• Email: [email protected] — Subject: "Data Privacy Request" or "Privacy Complaint"
• Live Chat: Available 24/7 from the pk86 Platform — please state that your query is a data privacy matter at the start of the conversation
• Response time: pk86 acknowledges all privacy-related contacts within 24 hours and aims to resolve standard requests within 30 days

16.2 If you are dissatisfied with pk86's handling of your personal data or its response to a data rights request, you have the right to escalate your complaint to the relevant supervisory or regulatory authority in accordance with applicable law in your jurisdiction. Details of the applicable authority are available from pk86 support upon request.

16.3 pk86 commits to engaging in good faith with all privacy complaints and to providing a substantive, reasoned response to each complaint received. pk86 views data privacy complaints as an opportunity to identify and address deficiencies in its data handling practices.