PKA98 Privacy Policy – How We Handle Your Data and Protect Your Rights

pka98 (operating at pka98.app) is the data controller responsible for the personal information you provide when registering and using the pka98 platform. As the data controller, pka98 determines what data is collected, how it is used and how long it is retained.

pka98 operates under a valid international gaming licence that imposes specific obligations around data protection, anti-money laundering (AML) compliance and Know Your Customer (KYC) verification. These legal obligations shape what data we must collect and how long we are required to keep it. The requirements are not optional for a licensed gaming platform – they exist to protect both players and the integrity of the financial system.

pka98 is committed to handling personal data in a lawful, transparent and fair manner. If you have any questions about this Privacy Policy or about how pka98 handles your personal data, please contact us at support@pka98.app. We will respond to all privacy enquiries within 30 calendar days.

pka98 collects personal data in three main ways: data you provide directly when registering or using the platform, data generated automatically by your use of pka98 and data provided by third-party payment processors and KYC verification services.

pka98 does not collect sensitive personal data categories such as health information, religious beliefs or political opinions unless specifically required by a regulatory investigation and authorised by the relevant authority. The data listed above represents the complete scope of what pka98 collects under normal operating circumstances.

pka98 collects and processes your personal data for specific, legitimate purposes. We do not collect data speculatively or for purposes we cannot justify. Below is a clear explanation of why each category of data is needed at pka98.

• Account Registration and Operation: Your name, contact details and date of birth are required to create and maintain your pka98 account, verify that you are aged 18 or over and communicate with you about your account.
• Identity Verification (KYC): pka98's gaming licence requires us to verify the identity of players, particularly for withdrawals above certain PKR thresholds. CNIC verification, proof of address and source of funds checks are part of this mandatory process.
• Payment Processing: Financial data is required to process PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card payments. pka98 shares only the minimum necessary financial data with payment processors to complete transactions.
• Anti-Money Laundering (AML) Compliance: pka98 is legally required to monitor transactions and player activity for signs of money laundering or financial crime. This involves processing transaction history and, in some cases, source of funds information.
• Responsible Gaming: Account activity data including session length, deposit frequency and betting patterns is used by pka98 to monitor for signs of problem gambling and to enforce responsible gaming tools such as deposit limits and self-exclusion.
• Platform Security: IP addresses and device data are used to detect and prevent fraud, account takeover attempts and abuse of pka98's promotional systems.
• Customer Support: Communication data is retained to maintain accurate records of support interactions and to resolve disputes at pka98 fairly and consistently.
• Platform Improvement: Aggregated, anonymised technical and activity data is used by pka98 to understand how the platform is used, identify performance issues and prioritise product improvements.

pka98 processes your personal data only where we have a valid legal basis to do so. The legal bases we rely on are as follows:

• Contract Performance: Much of the data processing at pka98 is necessary to fulfil our contract with you as a player – operating your account, processing bets, paying out winnings and handling deposits and withdrawals in PKR.
• Legal Obligation: pka98 is required by its gaming licence and applicable AML regulations to collect identity information, verify player details and retain transaction records. We cannot offer you platform access without complying with these obligations.
• Legitimate Interests: pka98 processes some data – including technical and security data – based on our legitimate interest in operating a secure, fair and commercially viable platform. We balance these interests against your privacy rights and do not override them.
• Consent: Where pka98 sends you marketing communications by email or SMS, we do so only with your explicit consent. You can withdraw consent at any time through your account settings or by contacting support@pka98.app.

pka98 does not sell your personal data. We do not share it with advertising networks, data brokers or any party that would use it for purposes unrelated to your pka98 account. Sharing only occurs where necessary to operate the platform, comply with legal obligations or protect player interests.

The categories of third parties with whom pka98 may share your data are as follows:

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT partners and card processors receive only the data required to process your specific PKR transaction. pka98 does not give payment processors access to your full account profile or betting history.
• KYC and Identity Verification Providers: pka98 uses licensed third-party identity verification services to process CNIC checks and document verification. These providers process your identity data strictly for the purpose of KYC verification on behalf of pka98.
• Live Casino Game Providers: When you play live dealer games at pka98, a minimum amount of session data is shared with the game provider to operate the live game. This does not include your full identity data or financial history.
• Regulatory Authorities: pka98 may be required to share player data with its licensing authority, financial intelligence units or law enforcement bodies in response to lawful orders or as part of our regulatory reporting obligations. pka98 cannot override such lawful requirements.
• IT and Hosting Providers: pka98's platform infrastructure runs on cloud hosting and technical service providers who may have incidental access to data as part of maintaining systems. All such providers are contractually bound by data protection obligations.

pka98 uses cookies and similar tracking technologies on its website and mobile interface. A cookie is a small text file placed on your device when you visit pka98. Cookies help the platform remember your preferences, keep you logged in and understand how the platform is being used.

pka98 uses the following types of cookies:

• Essential Cookies: These are required for pka98 to function. They keep you logged in during your session, maintain your bet slip state and enable secure payment flows. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These remember your preferences at pka98 such as your chosen language, display settings and responsible gaming reminders. Disabling these means pka98 cannot remember your settings between sessions.
• Analytics Cookies: pka98 uses anonymised analytics data to understand traffic patterns, page performance and feature usage. This data is aggregated and does not identify individual players.
• Security Cookies: These help pka98 detect and prevent fraudulent login attempts, account takeovers and bot activity by flagging unusual session patterns.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will affect your ability to use pka98 normally. pka98 does not use third-party advertising cookies or share cookie data with ad networks.

pka98 invests significantly in data security because the trust of Pakistani players depends on it. We implement multiple layers of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or disclosure.

• Encryption in Transit: All data transmitted between your device and pka98 servers is encrypted using TLS 1.3, the current industry standard for secure web connections.
• Encryption at Rest: Personal data stored in pka98 databases is encrypted using AES-256 encryption. Financial data and identity documents receive additional layers of encryption.
• Access Controls: Access to player data within pka98 is restricted to staff who have a specific operational need to access it. All access is logged and subject to regular audit.
• Two-Factor Authentication: pka98 offers and encourages two-factor authentication for player accounts. Our internal systems require it for all staff with access to player data.
• Penetration Testing: pka98 conducts regular independent security assessments including penetration testing and vulnerability scanning to identify and address potential weaknesses before they can be exploited.
• Incident Response: In the event of a data breach affecting pka98 players, we have a documented incident response procedure that includes notifying affected players and relevant authorities within the timeframes required by our licensing obligations.

pka98 retains personal data only for as long as it is necessary for the purpose for which it was collected, or for as long as required by our regulatory obligations. We do not keep data indefinitely without justification.

The standard retention periods at pka98 are as follows:

• Active Account Data: Retained for the duration of your pka98 account and for 5 years after account closure, in compliance with AML and gaming regulatory requirements.
• Transaction Records: All PKR deposit and withdrawal records are retained for a minimum of 5 years from the date of the transaction, as required by financial record-keeping regulations.
• Identity and KYC Documents: Retained for 5 years after account closure. This is a regulatory requirement and cannot be waived by a player deletion request during the mandatory retention period.
• Support Communications: Email and chat records are retained for 3 years from the date of the interaction unless they are connected to an ongoing complaint, dispute or investigation.
• Technical and Analytics Data: Anonymised analytics data may be retained indefinitely. Personally identifiable technical data (such as IP address logs) is deleted after 12 months.
• Marketing Preferences: Records of your marketing consent and opt-out choices are retained for 5 years to demonstrate compliance with consent obligations.

When data reaches the end of its retention period at pka98, it is securely deleted or anonymised. Anonymised data that can no longer be linked to any individual is not subject to the retention limits above and may be used indefinitely for aggregate analytics.

As a pka98 player, you have specific rights over your personal data. These rights are described below. To exercise any of them, contact pka98 at support@pka98.app with a clear description of your request. We will respond within 30 calendar days.