pkr99 Privacy Policy — How We Protect Your Personal Information

pkr99 ("we", "us", "our", "the Platform") operates the online gaming platform accessible at pkr99.bio and all associated domains and mobile interfaces. For the purposes of this Privacy Policy, pkr99 acts as the data controller in respect of personal information collected from users ("you", "your", "Player") of the pkr99 platform.

pkr99 holds a valid international gaming licence that imposes data protection obligations as a condition of continued operation. Our data handling practices are shaped both by those regulatory requirements and by our own commitment to treating Pakistani players with the respect their personal information deserves.

This Privacy Policy applies to all personal data collected through:

• The pkr99 website at pkr99.bio and all sub-domains;
• Any pkr99 mobile-optimised interface or progressive web application;
• Customer support interactions, including live chat and email correspondence;
• KYC (Know Your Customer) verification processes;
• Payment processing in connection with pkr99 deposits and withdrawals.

If you have any questions about who controls your data or how to contact our data protection point of contact, see Section 14 of this Policy.

pkr99 collects personal data through several channels. The following table provides a clear overview of the categories of information we collect and the primary source of each:

pkr99 uses personal data collected from Pakistani players for the following clearly defined purposes:

• Account Creation & Management: To register your pkr99 account, verify your identity and age (21+), maintain your account settings, and manage your ongoing relationship with the platform;
• Service Delivery: To enable you to access games, place sports bets, participate in promotions, and use all features of the pkr99 platform as intended;
• Payment Processing: To process deposits via JazzCash, EasyPaisa, Raast, and banking channels, and to facilitate withdrawal payments to your registered payment method;
• KYC & Regulatory Compliance: To verify your identity, age, and source of funds as required by pkr99's gaming licence and applicable anti-money laundering obligations;
• Fraud Prevention & Security: To detect suspicious activity, prevent unauthorised account access, identify bonus abuse, and protect the integrity of the pkr99 platform and its player community;
• Responsible Gaming: To monitor gaming patterns that may indicate problem gambling behaviour, to apply deposit and loss limits you have requested, and to enforce self-exclusion periods;
• Customer Support: To respond to your queries, resolve disputes, process complaints, and provide technical assistance;
• Legal Obligations: To comply with applicable laws, regulatory requirements, court orders, and lawful requests from competent authorities;
• Platform Improvement: To analyse aggregated and anonymised usage data in order to improve the pkr99 platform, game selection, and user experience. This analysis does not involve profiling individual players for commercial purposes;
• Marketing Communications: To send promotional offers, bonus notifications, and product updates to players who have consented to receive such communications. Marketing consent is always opt-in and can be withdrawn at any time.

pkr99 processes your personal data on the following legal bases:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of marketing consent does not affect your ability to use pkr99 Services.

pkr99 may share your personal data with the following categories of recipients:

• Payment Service Providers: JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, and other approved payment processors receive the minimum data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable financial regulation;
• KYC / Identity Verification Providers: Accredited third-party identity verification services that assist pkr99 in confirming player identity and age in compliance with our gaming licence requirements;
• Regulatory Authorities: Gaming regulatory bodies under whose licence pkr99 operates may require access to certain player records as part of their compliance oversight functions;
• Law Enforcement and Legal Authorities: Where required by a valid court order, warrant, or lawful request from a competent authority — including in connection with fraud investigations, money laundering inquiries, or criminal proceedings;
• IT and Security Service Providers: Cloud hosting providers, cybersecurity firms, and platform infrastructure partners who process data on pkr99's behalf under strict data processing agreements that prohibit independent use of player data;
• Game Providers: Third-party game providers whose titles appear in the pkr99 library may receive session data necessary for game operation and RNG certification. These providers do not receive identity or financial data beyond what is technically required for game functionality;
• Fraud Prevention Networks: Industry-standard fraud and responsible gaming databases that allow pkr99 to check self-exclusion status and detect multi-accounting across licensed operators.

All third parties with whom pkr99 shares personal data are contractually obligated to process that data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection law.

pkr99 uses cookies and similar tracking technologies to operate the platform effectively, maintain session security, and analyse aggregate usage patterns. The following categories of cookies are used on pkr99:

• Essential Cookies: Required for the pkr99 platform to function. These include session management cookies that keep you logged in securely, security tokens that protect against CSRF attacks, and preference cookies that remember your language and display settings. These cookies cannot be disabled without impairing platform functionality;
• Analytics Cookies: Used to collect anonymised and aggregated data about how players navigate the pkr99 platform — which game categories are most visited, how long sessions last, and which pages generate the most engagement. This data is used exclusively to improve the pkr99 experience and is never linked to individual player identities for commercial purposes;
• Security and Fraud Prevention Cookies: Used to detect abnormal behaviour patterns, identify automated bots, and flag potential account compromise attempts. These cookies are essential to platform integrity and player protection.

pkr99 retains personal data for only as long as necessary to fulfil the purposes described in this Policy and to comply with legal obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Where deletion is requested before the end of a mandatory retention period, pkr99 will restrict processing to the minimum extent required to fulfil the legal obligation.

pkr99 implements a comprehensive, multi-layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and pkr99 servers is encrypted using TLS 1.3 / 256-bit SSL — the same standard employed by major international financial institutions;
• Encryption at Rest: Sensitive personal data stored on pkr99 servers — including identity documents, financial information, and authentication credentials — is encrypted using AES-256 encryption;
• Access Controls: Access to personal data within pkr99's internal systems is restricted on a strict need-to-know basis. Staff members can only access the categories of data necessary for their specific role. All internal access is logged and audited;
• Password Security: pkr99 stores account passwords using industry-standard hashing algorithms with per-account salting. We never store passwords in plaintext and will never ask you to share your password with any pkr99 representative;
• Two-Factor Authentication: OTP-based verification is used for account login and sensitive account actions, providing an additional layer of protection beyond your password;
• Regular Security Audits: pkr99's platform security is reviewed periodically by independent third-party security specialists. Identified vulnerabilities are addressed through our structured patch management process;
• Data Breach Response: pkr99 maintains a documented incident response plan for data security events. In the event of a breach that presents a material risk to affected players, we will notify impacted individuals and the relevant regulatory authority within the timeframe required by applicable law.

As a pkr99 player, you have the following rights in relation to your personal data. pkr99 will respond to all valid requests without charge and within a reasonable timeframe — typically 30 days from receipt of a complete request:

• Right to Access: You may request a copy of all personal data pkr99 holds about you, along with information about how it is used, where it came from, and with whom it has been shared. This is commonly known as a Subject Access Request (SAR);
• Right to Rectification: If any personal data pkr99 holds about you is inaccurate or incomplete, you have the right to have it corrected. For standard account details, you may update information directly in your pkr99 account settings. For KYC document corrections, please contact Support;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, where you withdraw consent (and no other legal basis applies), or where processing was unlawful. Note that this right is subject to our legal retention obligations — we cannot erase data we are legally required to retain;
• Right to Restriction of Processing: You may request that pkr99 restrict the processing of your data — for example, while a rectification request is being assessed, or where you contest the lawfulness of processing;
• Right to Data Portability: Where processing is based on your consent or a contract with you, you may request that pkr99 provide your personal data in a structured, commonly used, machine-readable format that you can transfer to another organisation;
• Right to Object: You have the right to object to processing of your personal data where pkr99 relies on legitimate interests as the legal basis. You also have an unconditional right to object to processing for direct marketing purposes at any time;
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal is effective immediately and can be exercised through your account settings or by contacting Support.

To exercise any of these rights, contact pkr99 via Live Chat or at the email address in Section 14. We may need to verify your identity before processing your request to protect against unauthorised data access.

pkr99 implements multiple age verification measures to prevent underage access, including self-declaration during registration and mandatory KYC verification before withdrawals. These measures are a condition of our gaming licence.

Parents and guardians who are concerned that a minor may be accessing pkr99 are encouraged to:

• Use device-level parental control tools available from mobile operating systems and internet service providers to block access to gambling-related content;
• Contact pkr99 Support immediately if they suspect a minor has registered an account — we will investigate and act swiftly;
• Visit our Responsible Gaming page for additional resources on protecting minors from exposure to gambling content.

pkr99 may send you promotional offers, bonus notifications, new game announcements, and other marketing materials by SMS, email, or push notification — but only where you have provided clear, affirmative consent to receive such communications.

Marketing consent on pkr99 operates on the following principles:

• Opt-In: We never pre-tick marketing consent boxes during registration. Consent is obtained through a clear, separate, and positive action on your part;
• Granular Control: You may consent to different types of marketing communications separately — for example, consenting to bonus notifications while declining general promotional emails;
• Easy Withdrawal: You can withdraw marketing consent at any time through your pkr99 account settings under "Communication Preferences", or by clicking the unsubscribe link in any marketing email, or by contacting pkr99 Support. Withdrawal takes effect within 48 hours for email communications and immediately for push notifications;
• No Penalty: Withdrawing marketing consent does not affect your ability to use pkr99 Services, access your account, or receive essential service communications such as withdrawal confirmations, security alerts, and account notifications;
• Self-Exclusion Override: If you have applied a self-exclusion or cooling-off period through pkr99's responsible gaming tools, all marketing communications will be automatically suspended for the duration of that period, regardless of your general marketing consent status.

pkr99 operates through internationally distributed infrastructure, which means your personal data may be transferred to and processed in countries outside Pakistan. These transfers may include cloud server infrastructure hosted in jurisdictions with different data protection frameworks to Pakistan.

Where personal data is transferred internationally, pkr99 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections described in this Privacy Policy. These safeguards include:

• Contractual data processing agreements with all international service providers, binding them to maintain security and data protection standards consistent with this Policy;
• Transfers to jurisdictions recognised as providing adequate data protection, where applicable;
• Technical encryption measures that protect data in transit regardless of the jurisdiction through which it passes.

pkr99 does not transfer personal data to international parties for commercial purposes. All international data transfers are strictly limited to operational necessity — for example, cloud infrastructure hosting or payment processing — and are governed by contractual protections.

pkr99 may update this Privacy Policy from time to time to reflect changes in our data practices, platform functionality, or applicable legal requirements. Where changes are material — for example, a significant change in how we use your data or a new category of data sharing — we will notify you in advance via email or on-platform notification before the changes take effect.

Minor updates — such as clarifications of existing practices, corrections of typographical errors, or updates to contact information — may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of pkr99 Services following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not accept an updated Policy, you should stop using pkr99 and may request account closure through Support.

The current version of this Privacy Policy is always available at pkr99.bio/privacy-policy. We recommend reviewing it periodically.

For any questions, concerns, or requests relating to this Privacy Policy or pkr99's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the pkr99 platform. For data rights requests (access, deletion, rectification), please state clearly in your opening message that you are submitting a data privacy request;
• Email: [email protected] — Please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate. We aim to acknowledge all privacy-related emails within 2 business days and to provide a substantive response within 30 days;
• Languages: Privacy enquiries may be submitted in English or Urdu. Our support team includes Urdu-speaking agents who can handle data privacy requests in either language.