Privacy Policy — pk18 Data Commitment

This Privacy Policy ("Policy") describes how pk18 ("pk18", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the pk18 platform at pk18.pro, including all associated services, games, mobile interfaces, and promotional features.

pk18 takes your privacy seriously. As Pakistan's leading online casino and sports betting platform — trusted by players across Karachi, Lahore, Islamabad, Faisalabad, and beyond — we understand that the trust you place in us extends beyond the games we offer. It includes how responsibly we handle the personal information you share with us.

By registering an account, making a deposit, or continuing to use the pk18 platform after this Policy has been published or updated, you confirm that you have read, understood, and agreed to the practices described herein. This Policy forms an integral part of the pk18 Terms & Conditions.

For the purposes of applicable data protection law, pk18 acts as the data controller in respect of the personal data of its registered Players and website visitors. This means pk18 determines the purposes for which your personal data is collected and the manner in which it is processed.

Where pk18 engages third-party service providers to process data on our behalf — for example, payment processors such as JazzCash and EasyPaisa, KYC verification providers, or analytics platforms — those third parties act as data processors and are contractually bound to process your data only on pk18's documented instructions and in accordance with applicable data protection obligations.

pk18 operates under an internationally recognised gaming licence and complies with the data protection and privacy standards required by its licensing authority. Specific licensing details are available upon reasonable request to our compliance team.

pk18 collects personal data across the following categories. Only data that is relevant and necessary for the stated purpose is collected:

pk18 collects your personal data through the following channels:

• Direct collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or completing any form on the pk18 platform.
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and similar tracking technologies when you interact with the pk18 website or mobile interface. See Section 8 for full cookie details.
• Third-party sources: Identity and fraud-screening data received from KYC verification providers, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa/Mastercard), and anti-fraud services, where you have authorised those third parties to share data with pk18 or where pk18 is legally required to conduct such checks.
• Public sources: In limited circumstances relating to fraud investigation or regulatory compliance, pk18 may cross-reference data against publicly available records, sanctions lists, or politically exposed persons (PEP) databases.

pk18 uses your personal data for the following specific purposes:

1. Account creation and management: To register your account, verify your identity, maintain your account balance, and enable access to all pk18 platform features.
2. KYC and age verification: To confirm that you are at least 21 years of age and to comply with our obligations under applicable gaming regulations. pk18 enforces a strict minimum age of 21 for all real-money activity.
3. Payment processing: To facilitate deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card payments, and to process withdrawal requests to your registered payment method in PKR.
4. Regulatory and legal compliance: To meet our anti-money-laundering (AML), counter-terrorism financing (CTF), and tax reporting obligations as required by our licensing authority and applicable law.
5. Fraud and security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, bonus abuse, and any other conduct that poses a risk to the platform or its players.
6. Responsible gaming: To monitor gameplay patterns, identify indicators of problem gambling, and administer deposit limits, cooling-off periods, and self-exclusion requests in accordance with our Responsible Gaming policy.
7. Customer support: To respond to your queries, resolve complaints, and maintain records of our interactions with you for quality assurance purposes.
8. Marketing communications: To send you promotional offers, bonus notifications, and personalised recommendations — but only where you have explicitly opted in to receive such communications. You may opt out at any time.
9. Platform improvement: To analyse usage patterns and technical performance, enabling us to improve the pk18 platform, fix issues, and develop new features for Pakistani players.

Every data processing activity carried out by pk18 is grounded in one of the following recognised legal bases:

• Contractual necessity: Processing required to perform the contract between you and pk18 — including account management, payment processing, and game delivery.
• Legal obligation: Processing required for pk18 to comply with applicable laws and regulatory requirements, including KYC, AML, and licensing conditions.
• Legitimate interests: Processing carried out to protect the security and integrity of the pk18 platform, prevent fraud, and improve our services, where these interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — principally for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

pk18 does not sell your personal data. We share your data only in the following limited and controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card scheme partners receive financial data strictly necessary to process your transactions.
• KYC and identity verification providers: Third-party verification platforms receive your identity documents and biometric data solely for the purpose of confirming your identity and age in compliance with our regulatory requirements.
• Game and technology providers: Certain gameplay data (such as bet history and session activity) may be processed by our certified game providers and platform technology partners for the purpose of delivering and auditing games.
• Fraud prevention and AML services: Aggregated or pseudonymised data may be shared with specialised fraud detection services and sanctions screening providers as part of our platform security infrastructure.
• Regulatory and law enforcement bodies: pk18 will disclose personal data to regulators, gaming authorities, financial intelligence units, or law enforcement agencies where required to do so by applicable law or a lawful order. We are not required to notify you of such disclosures in all circumstances.
• Professional advisers: Legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis under confidentiality obligations.

All third-party data processors engaged by pk18 are subject to written data processing agreements that require them to process your data only on pk18's documented instructions and to implement appropriate technical and organisational security measures.

pk18 uses cookies and similar tracking technologies to operate the platform, enhance your experience, and gather analytics. The following categories of cookies are used:

You can manage your cookie preferences at any time via your browser settings or the pk18 cookie preference centre accessible from the footer of the platform. Disabling strictly necessary cookies will impair the functionality of the pk18 platform and may prevent you from logging in or completing transactions.

pk18 retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account and identity data (active accounts): Retained for the duration of the account relationship and for a period of 5 years following account closure, in line with standard AML record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of verification, or longer if required by applicable regulatory guidance.
• Transaction and wagering records: Retained for 5 years from the date of each transaction, in accordance with financial record-keeping obligations.
• Support and communications data: Retained for 3 years from the date of the last interaction, except where a dispute or complaint is open, in which case records are retained until final resolution.
• Technical and usage data: Typically retained in aggregated, anonymised form for up to 2 years for platform analytics purposes.
• Marketing consent records: Retained for the duration of the consent period and for 2 years following withdrawal of consent, for compliance evidence purposes.

On expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to you as an individual.

pk18 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• 256-bit TLS encryption for all data in transit between your device and pk18 servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment credentials.
• Multi-factor authentication for all pk18 staff accessing systems that hold personal data.
• Role-based access controls ensuring that employees can only access data necessary for their specific job function.
• Regular penetration testing and independent security audits of the pk18 platform infrastructure.
• Intrusion detection systems and 24/7 security monitoring across all production environments.
• Secure data centre hosting with physical access controls, redundancy, and disaster recovery protocols.

While pk18 employs industry-leading security practices, no digital platform can guarantee absolute security. You are also responsible for maintaining the security of your own account — please use a strong, unique password and never share your credentials with anyone. If you suspect unauthorised access to your pk18 account, contact our support team immediately.

As a pk18 player, you hold the following rights in relation to your personal data. You may exercise any of these rights at any time by contacting our support team at the details provided in Section 15:

pk18 operates an unconditional minimum age of 21 for all registered players. The pk18 platform is not directed at, and is not intended for use by, any individual under the age of 21. We do not knowingly collect or retain personal data relating to individuals under 21.

Where pk18 has reasonable grounds to suspect that a registered player is under 21 years of age, that account will be immediately suspended pending age verification. If verification cannot be completed satisfactorily, the account will be permanently closed and any real-money balance will be returned via the registered payment method following investigation.

pk18's primary servers are located in jurisdictions that maintain a high standard of data protection. However, the nature of operating a global online gaming platform means that some of your personal data may be processed by third-party service providers located in countries outside Pakistan.

Where personal data is transferred internationally, pk18 ensures that adequate safeguards are in place, including contractual clauses that impose data protection obligations on the recipient equivalent to those that apply within pk18's operating jurisdiction. pk18 does not transfer personal data to any country or territory that does not provide an adequate level of data protection without first putting appropriate safeguards in place.