pk38 Privacy Policy —
Your Data, Your Rights

This Privacy Policy applies to all personal data processed by pk38 in connection with the operation of the pk38.bid website, including account registration, identity verification (KYC), financial transactions, gaming activity, customer support interactions, and promotional communications. By registering a pk38 account or using any pk38 Service, you acknowledge that you have read and understood this Privacy Policy.

pk38 is the data controller responsible for the processing of your personal data as described in this Policy. pk38 operates the pk38.bid platform under an international gaming licence and is subject to the regulatory data protection requirements associated with that licence.

This Privacy Policy should be read alongside the pk38 Terms & Conditions which govern the overall use of the pk38 platform and form part of the same contractual framework.

pk38 collects the following categories of personal data in the course of operating the platform. The specific data items collected depend on the nature of your interaction with pk38 and the services you use.

pk38 collects personal data through the following channels and mechanisms:

3.1 Direct Collection

Data you actively provide when you register a pk38 account, complete KYC verification, submit a deposit or withdrawal request, contact customer support, update your account preferences, or opt in to promotional communications. This includes all Identity Data, Contact Data, and Marketing Data categories described in Section 2.

3.2 Automated Collection

Data automatically generated and recorded by pk38 platform systems when you log in, browse the platform, place bets, play casino games, or interact with any pk38 service. This includes Technical Data, Gaming Data, and session-level Account Data. Automated collection uses server logs, session cookies, and platform instrumentation — no third-party analytics scripts are deployed on pk38 without disclosure.

3.3 Third-Party Collection

In limited circumstances, pk38 may receive personal data from third-party sources, including: payment gateway transaction confirmations (Financial Data); fraud prevention service risk assessments (Technical Data); and regulatory authority data requests requiring cross-referencing of player information. pk38 does not purchase personal data from data brokers or unaffiliated commercial data sources.

pk38 processes your personal data for the following specific, documented purposes. Data is not processed for purposes beyond those listed here unless additional consent is obtained or a new legal basis is established.

• Account Registration & Management: To create your pk38 account, verify your identity and age (21+ requirement), authenticate login sessions via OTP, and maintain your account in good standing.
• Gaming & Betting Operations: To process your bets, settle game outcomes, display game history, maintain your PKR wallet balance, and operate the sportsbook, live casino, slot, Fishing Expert, Bird Catcher, and all other pk38 gaming products.
• Financial Transactions: To process deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank; process withdrawals to your registered payment method; reconcile transaction records; and maintain audit-ready financial logs.
• Regulatory Compliance: To meet licensing obligations including KYC (Know Your Customer), AML (Anti-Money Laundering) checks, responsible gaming obligations, suspicious activity reporting, and regulatory audit requirements.
• Customer Support: To respond to your queries, resolve complaints, and maintain records of interactions in accordance with the dispute resolution procedures set out in the pk38 Terms & Conditions.
• Security & Fraud Prevention: To detect and prevent fraudulent activity, unauthorised account access, bonus abuse, collusion, and other prohibited conduct as defined in the pk38 Terms & Conditions.
• Platform Improvement: To analyse aggregated, de-identified usage data for the purpose of improving platform performance, game selection, user interface design, and payment processing reliability.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Players who have opted in to marketing communications. You may withdraw marketing consent at any time from your pk38 account settings.

pk38 processes your personal data under the following legal bases, each aligned with the specific purpose of processing:

• Contractual Necessity: Processing required to perform the pk38 Terms & Conditions — including account management, gaming operations, financial transactions, and customer support — is conducted on the basis of contractual necessity. Without this processing, pk38 cannot provide the Services you have requested.
• Legal Obligation: Processing required by the terms of pk38's international gaming licence — including KYC verification, AML monitoring, age verification (21+ policy), and regulatory reporting — is conducted on the basis of legal obligation. This processing occurs regardless of Player consent.
• Legitimate Interest: Processing for security and fraud prevention, platform improvement, and risk management is conducted on the basis of pk38's legitimate interest in maintaining a secure, functional, and compliant platform. pk38 has assessed that these interests do not override the fundamental rights of Players.
• Consent: Processing for marketing communications and non-essential cookies is conducted on the basis of consent, which you provide at the time of account registration or through your account settings. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

pk38 shares personal data only with the following categories of recipients, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: JazzCash, EasyPaisa, and banking partners (HBL, UBL, Meezan Bank) receive the transaction-level data necessary to process your deposits and withdrawals. This data is subject to each payment provider's own privacy policies and processing standards.
• Gaming Licence Authority: pk38's international licensing regulator may request access to player records as part of compliance audits, complaint escalation, or regulatory investigation. pk38 is legally required to comply with such requests.
• Fraud Prevention Services: pk38 may share Technical Data and Account Data with specialised fraud prevention partners for the purpose of real-time risk assessment during login, deposit, and withdrawal events.
• Game Studio Partners: Live casino and slot game providers receive a pseudonymised player identifier and session data necessary to operate the game — they do not receive your full name, CNIC, mobile number, or financial information.
• Law Enforcement: pk38 will disclose personal data to law enforcement authorities when required by a valid legal order, court order, or regulatory instruction. pk38 will notify affected Players of such disclosure unless legally prohibited from doing so.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by pk38 may access personal data under confidentiality agreements in the course of providing professional services to pk38.

pk38 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to overriding legal retention obligations imposed by the international gaming licence. The following retention schedules apply:

• Active Account Data: Retained for the duration of the account relationship. Upon account closure, core account records are retained for a minimum of 5 years to satisfy regulatory audit and AML record-keeping obligations.
• KYC Documentation: CNIC copies, selfie photographs, and identity verification records are retained for a minimum of 5 years from account closure, as mandated by anti-money laundering regulations applicable to the pk38 licence.
• Financial Transaction Records: Deposit, withdrawal, and wallet transaction records are retained for a minimum of 7 years in accordance with financial record-keeping requirements.
• Gaming Data: Bet history, game session logs, and casino hand records are retained for a minimum of 5 years from the date of the transaction for regulatory audit and dispute resolution purposes.
• Technical & Session Data: IP addresses, device identifiers, and session logs are retained for 12 months from the date of collection, after which they are either anonymised or deleted.
• Marketing Preferences: Opt-in and opt-out records are retained for the duration of the account plus 1 year post-closure, to evidence consent compliance history.
• Support Interactions: Live chat transcripts and complaint records are retained for 3 years from the date of interaction for quality assurance and dispute reference purposes.

pk38 applies technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures are designed to meet or exceed the standards required by the pk38 international gaming licence.

8.1 Technical Measures

• Encryption in Transit: All data transmitted between your device and the pk38 platform is encrypted using TLS 1.3 / 256-bit SSL encryption.
• Encryption at Rest: Sensitive personal data stored on pk38 servers — including KYC documentation and financial records — is encrypted at rest using AES-256 encryption.
• Password Security: Passwords are never stored in plain text. pk38 uses bcrypt hashing with per-account salt to protect stored password credentials.
• Payment Tokenisation: JazzCash, EasyPaisa, and bank account credentials are processed through tokenised payment gateways — pk38 servers never receive or store full payment account numbers.
• OTP Verification: Two-factor authentication via SMS one-time passwords is applied to new device logins, password reset flows, and sensitive account changes.
• Rate Limiting & Intrusion Detection: pk38 deploys automated brute-force protection, rate limiting on login endpoints, and real-time intrusion detection monitoring across all production infrastructure.

8.2 Organisational Measures

• Access Controls: Access to personal data is restricted to authorised pk38 personnel on a need-to-know basis, with role-based permissions enforced across all internal systems.
• Staff Training: All pk38 personnel with access to personal data complete mandatory data protection training upon onboarding and annually thereafter.
• Incident Response: pk38 maintains a documented data breach response procedure that includes detection, containment, impact assessment, regulatory notification (where required), and affected Player notification within 72 hours of confirmed breach discovery.

pk38 uses cookies and similar browser-based storage technologies to operate the platform securely and effectively. The following types of cookies are deployed on pk38.bid:

• Strictly Necessary Cookies: Required for the functioning of the pk38 platform — authentication session tokens, security cookies, and load-balancing identifiers. These cookies cannot be disabled without breaking platform functionality. No consent is required for strictly necessary cookies.
• Functional Cookies: Used to remember your preferences, such as language selection, display settings, and recent game history shortcuts. These cookies enhance your experience but are not essential for platform operation.
• Analytics Cookies: Used to collect aggregated, de-identified usage data to help pk38 understand platform traffic patterns, popular games, and user interface performance. pk38 does not use third-party advertising cookies or cross-site tracking scripts.

You may configure your browser to reject non-essential cookies. Be aware that disabling strictly necessary cookies will prevent you from logging into your pk38 account. Cookie preferences set through your browser apply to the specific device and browser combination in use.

pk38 respects the data rights of all Players. You have the following rights in relation to your personal data held by pk38, which may be exercised by contacting pk38 customer support via live chat or by submitting a request through the pk38 Account dashboard:

• Right of Access: You have the right to request a copy of all personal data pk38 holds about you. pk38 will respond to access requests within 30 days and provide data in a commonly used, machine-readable format.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data. Corrections to Identity Data may require re-submission of KYC documentation.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes it was collected. This right is subject to overriding legal retention obligations — pk38 cannot delete data that must be retained under gaming licence or AML regulations (see Section 7).
• Right to Restrict Processing: You have the right to request restriction of processing of your personal data while a dispute regarding data accuracy or processing lawfulness is resolved.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you have the right to receive your data in a structured, machine-readable format and to have it transmitted to another data controller where technically feasible.
• Right to Withdraw Consent: Where processing is based on consent (marketing communications, non-essential cookies), you may withdraw consent at any time through your pk38 Account settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Complain: You have the right to lodge a complaint with the data protection authority of the jurisdiction in which pk38 holds its gaming licence if you believe your data rights have been violated.

If you are a parent or guardian and believe that a minor under 21 has created a pk38 account or provided personal data to pk38, please contact pk38 customer support immediately so that we can investigate and take appropriate action. pk38's CNIC-based KYC verification is designed to prevent minors from completing the verification process, but early intervention by parents and guardians is always welcome.

pk38 may update this Privacy Policy from time to time to reflect changes in data processing practices, regulatory requirements, or platform functionality. Where changes are material — meaning they significantly affect how your data is collected, used, or shared — pk38 will provide notice via your registered mobile number or pk38 Account inbox at least 7 days before the changes take effect.

The "Last Updated" date at the top of this document indicates the effective date of the current version. Continued use of the pk38 platform after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. Previous versions of this Policy may be requested through pk38 customer support.

For any questions, concerns, or requests relating to this Privacy Policy, your personal data, or your data rights under this Policy, please contact pk38 through the following channel:

© 2026 pk38. This Privacy Policy is effective as of 01 January 2026 and supersedes all prior privacy policy versions. pk38 is an internationally licensed online gaming platform. Play responsibly.