98pak Privacy Policy —
How We Protect Your Personal Data

This Privacy Policy ("Policy") applies to all personal data collected and processed by 98pak in connection with the operation of the 98pak online casino and sports betting platform accessible at 98pak.bio (the "Platform"). It covers all Services offered through the Platform, including but not limited to casino games, live dealer tables, sports betting markets, arcade games, payment processing, promotional offers, customer support interactions, and account management functions.

This Policy applies to all registered 98pak players, prospective players who browse the Platform without registering, and any person who contacts 98pak through any communication channel. By using the 98pak Platform, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein.

This Policy should be read alongside the 98pak Terms & Conditions and Responsible Gaming Policy, all of which form part of the overall agreement between you and 98pak.

98pak acts as the Data Controller in respect of personal data collected from players and users of the Platform. As Data Controller, 98pak determines the purposes and means of processing personal data and is responsible for ensuring that processing is carried out in accordance with applicable data protection obligations under its international gaming licence framework.

For data protection enquiries, rights requests, or complaints regarding 98pak's handling of your personal data, please contact the 98pak Data Protection Officer (DPO) using the contact details provided in Section 17 of this Policy. 98pak commits to responding to all data protection queries within 30 calendar days of receipt.

98pak collects the following categories of personal data from players and Platform users. The specific data collected depends on the Services you use and the extent to which you interact with the Platform:

98pak collects personal data through the following methods:

• Direct Collection: Data you provide when registering your 98pak Account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions. This includes all form submissions, document uploads, and live chat interactions.
• Automated Collection: Data collected automatically when you visit or use the Platform, including IP addresses, device identifiers, session data, and gameplay records. This is collected via server logs, cookies, and similar tracking technologies as described in Section 10.
• Third-Party Sources: Identity verification data confirmed through authorised KYC verification service providers. Transaction data confirmed through integrated payment gateways (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank). Fraud prevention data from licensed third-party screening services used to protect Platform integrity.

98pak processes personal data only where a valid legal basis exists. The following table sets out the primary purposes of processing and the corresponding legal basis for each:

98pak does not sell personal data to any third party. We share personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• KYC Verification Providers: Authorised identity verification service providers who process your CNIC and selfie data to confirm your identity and age. These providers are contractually bound to process data only for the purposes instructed by 98pak and are prohibited from using it for any other purpose.
• Payment Processing Partners: Integrated payment gateways (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and crypto processors) receive transaction data necessary to process your specific deposit or withdrawal request. Each operates under its own privacy policies and data security standards.
• Fraud Prevention Services: Licensed third-party fraud screening platforms receive technical data (IP address, device fingerprint) for the purpose of identifying fraudulent access patterns, multi-account abuse, and suspicious transaction behaviour. 98pak uses these services to protect both the platform and individual players.
• Gaming Software Providers: Game studios whose titles are hosted on the 98pak Platform may receive anonymised or pseudonymised gameplay data for technical support and game performance purposes. Personal identity data is not shared with game studios.
• Regulatory and Legal Authorities: Where required by law, court order, or instruction from a competent regulatory authority, 98pak will disclose personal data to the relevant body. 98pak will, where legally permissible, notify affected players of such disclosures.
• Professional Advisors: Legal, accounting, and audit professionals engaged by 98pak may have access to personal data in connection with their professional services, subject to professional confidentiality obligations.

In operating a platform that serves Pakistani players under an international gaming licence, some personal data may be transferred to and processed in jurisdictions outside Pakistan. Specifically, this may include server infrastructure locations, KYC verification service providers, and gaming software support operations.

Where such transfers occur, 98pak ensures that appropriate safeguards are in place to protect your personal data, including:

• Contractual clauses in all third-party service provider agreements that require equivalent data protection standards.
• Restriction of international transfers to service providers located in jurisdictions with recognised data protection frameworks or subject to equivalent contractual protections.
• Ongoing assessment of the data protection standards maintained by all international recipients of 98pak player data.

If you have questions about specific international transfers of your data, you may contact the 98pak Data Protection Officer using the details in Section 17.

98pak retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following retention schedule:

• Active Account Data: Retained for the duration of the player's account registration and for a period of 5 years following permanent account closure, to fulfil anti-money laundering regulatory obligations under the international gaming licence.
• KYC Documents (CNIC, selfie): Retained for 5 years from the date of verification completion, as required under AML compliance obligations. Securely destroyed at the end of the retention period.
• Financial Transaction Records: Retained for 7 years from the date of transaction, in compliance with standard financial record-keeping obligations applicable to licensed gaming operators.
• Gaming and Betting Records: Retained for 5 years from the date of each gaming session or transaction, for regulatory reporting and dispute resolution purposes.
• Support Communications: Live chat transcripts and email records are retained for 3 years from the date of the interaction, to support ongoing account management and dispute resolution.
• Marketing Preferences: Retained until you withdraw your consent to marketing communications, at which point your preference is updated and maintained as a suppression record to prevent accidental re-contact.
• Technical/Log Data: Retained for 12 months from collection, after which it is purged from active systems. Aggregated anonymised analytics derived from log data may be retained indefinitely.

98pak implements and maintains comprehensive technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit TLS encryption for all data transmitted between your device and 98pak servers.
• AES-256 encryption for personal data stored at rest on 98pak infrastructure, including all KYC documents and financial records.
• Passwords stored exclusively as salted cryptographic hashes — never in plain text at any stage.
• Role-based access controls limiting internal access to personal data strictly to employees whose job functions require it.
• Multi-factor authentication required for all 98pak administrative system access.
• Regular penetration testing and vulnerability scanning of the Platform and supporting infrastructure.
• Continuous monitoring of system access logs for anomalous or unauthorised activity.
• Physical security controls at all data processing facilities, including restricted access and CCTV monitoring.
• Documented incident response procedures enabling rapid detection, containment, and notification in the event of a data security incident.

While 98pak takes extensive measures to protect your data, no system is entirely immune to security risks. You also play a role in protecting your own data by maintaining a strong, unique password for your 98pak Account, enabling two-step verification, and logging out of your Account after each session — particularly on shared devices.

98pak uses cookies and similar tracking technologies on the Platform to support essential functionality, maintain session security, and analyse Platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in during your 98pak session, security cookies that detect and prevent fraudulent login attempts, and load-balancing cookies. These cannot be disabled without breaking Platform functionality.
• Functional Cookies: Store your Platform preferences — such as language settings, responsible gaming limits displayed, and last-viewed game categories — so you do not need to reconfigure them on each visit.
• Analytics Cookies: Collect anonymised data about how players navigate and use the Platform, which pages receive the most visits, where errors occur, and how session flows can be improved. This data is aggregated and does not identify individual players.
• Security Cookies: Device fingerprinting components that help 98pak identify unusual login patterns — such as a login from an unrecognised device — and trigger appropriate security alerts or OTP verification requirements.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from using certain 98pak Platform features, including maintaining a logged-in session. 98pak does not use cookies for third-party advertising or cross-site tracking purposes.

As a player whose personal data is processed by 98pak, you have the following rights in respect of your personal information. These rights are subject to applicable legal exceptions and verification of your identity before 98pak can act on any request:

To exercise any of the above rights, contact 98pak via live chat or the email address in Section 17. 98pak will acknowledge your request within 5 working days and complete the action within 30 calendar days, or notify you if additional time is required for complex requests.

If you believe that a minor has registered an Account on 98pak using false information, please contact 98pak support immediately via live chat. 98pak will investigate the report promptly and take appropriate action, including Account suspension and data deletion in accordance with this Policy.

Parents and guardians are encouraged to use parental control software to restrict access to online gambling websites from shared devices. 98pak cooperates with responsible gaming initiatives that help identify and protect underage users across digital gaming platforms.

Where you have opted in during registration or subsequently updated your preferences, 98pak may send you marketing communications via SMS or email. These communications may include promotional bonus offers, game launch announcements, PSL betting promotions, jackpot notifications, and other platform updates relevant to 98pak players.

The following conditions apply to 98pak marketing communications:

• Marketing communications are sent only to players who have explicitly opted in at registration or via Account Settings. Opt-in is never pre-selected by default.
• You may withdraw your consent to marketing communications at any time by updating your preferences in Account Settings, or by contacting 98pak support via live chat. Opt-out requests take effect within 5 working days.
• Withdrawal of marketing consent does not affect your access to 98pak Platform Services or your right to receive transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent regardless of marketing preference.
• 98pak does not share your contact details with third parties for their own direct marketing purposes.

The 98pak Platform may display information about third-party games, software providers, or payment methods. These third-party services operate under their own privacy policies and terms of service. 98pak is not responsible for the data practices of any third-party service provider, game studio, or payment processor accessed in connection with your 98pak Account.

All integrated third-party services used on the 98pak Platform are vetted for data security compliance and are subject to contractual data processing agreements that restrict their use of player data to the functions they perform for 98pak. 98pak does not endorse and is not responsible for the content, privacy policies, or practices of any third-party websites that may be referenced in external communications.

98pak processes gaming behavioural data — including session duration, betting frequency, deposit patterns, and loss sequences — as part of its responsible gaming monitoring obligations under the international gaming licence. This processing is carried out on the legal basis of legal obligation and legitimate interests (player protection).

The responsible gaming data processing activities on 98pak include:

• Automated monitoring of gaming patterns to identify indicators of problematic gambling behaviour, such as escalating deposit amounts, chasing losses, or extended continuous session durations.
• Generating responsible gaming intervention triggers that prompt the 98pak support team to reach out to players displaying concerning patterns, or automatically display reality check notifications within the Platform.
• Maintaining records of self-exclusion requests, deposit limits, and other responsible gaming preferences to ensure these controls remain in force and cannot be circumvented.
• Sharing aggregated and anonymised responsible gaming data with the licensing authority for regulatory reporting purposes.

This processing is not used for commercial profiling or marketing targeting — it is exclusively a player protection measure operated as a regulatory requirement and ethical commitment of the 98pak platform. If you have concerns about how your gaming data is being used, contact the 98pak DPO directly.

98pak reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, new regulatory requirements, or developments in the services offered on the Platform. When material changes are made — those that affect your rights or how your data is processed in a significant way — 98pak will notify registered players via email or SMS to the contact details held on your Account, with a minimum of 14 days' notice before the updated Policy takes effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. The current version number is shown alongside the date. We encourage you to review this Policy periodically to stay informed about how 98pak protects your data.

Your continued use of the 98pak Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you disagree with any change, you have the right to close your Account and request deletion of your personal data as described in Section 11, subject to mandatory retention obligations.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 98pak handles your personal data, please contact the 98pak Data Protection Officer (DPO) or general support team through the following channels:

• Live Chat: Available 24/7 inside your 98pak Account — the fastest route to any support or privacy query, with typical first-response times of 3 to 5 minutes.
• Email (plain text — not a link): support@98pak.bio — for formal data rights requests, DPO escalations, and privacy complaints. Mark your message "Data Protection Request" for priority routing to the DPO team.

98pak commits to acknowledging all written privacy queries within 5 working days and to providing a substantive response within 30 calendar days. Where a request is complex or involves a high volume of data, 98pak may extend this period by a further 60 days, with notice provided to you within the initial 30-day window.