pak399 Privacy
Policy & Data Protection

1 Who We Are

pak399 is an online gaming and sports betting platform serving players across Pakistan. The platform operates at pak399.pro and offers products including cricket betting (with a focus on HBL Pakistan Super League markets), La Liga football betting, Jackpot Slots, Live Casino, Cockfighting markets, and Lottery — all denominated in Pakistani Rupee (PKR).

For the purposes of this Policy, pak399 acts as the data controller in respect of personal data collected from players and visitors. If you have any questions about how we handle your data, the contact details for our privacy team are provided at the end of this Policy.

2 Data We Collect

pak399 collects personal data through several channels as described below. We collect only what is necessary for the purposes set out in this Policy.

2.1 Registration Data

When you create a pak399 Account, we collect:

• Full legal name
• Date of birth (to verify you are 18 or older)
• Residential address in Pakistan
• Mobile phone number
• Email address
• Username and encrypted password

2.2 Identity Verification (KYC) Data

To comply with our Know Your Customer obligations and to verify your identity and age, we may request:

• A copy of your Pakistani CNIC (Computerised National Identity Card) or passport
• Proof of address (e.g., utility bill or bank statement issued within the last three months)
• Proof of payment method ownership (e.g., a screenshot of your Easypaisa or JazzCash account showing your registered name and mobile number)

2.3 Financial Transaction Data

When you deposit or withdraw funds, we collect transaction records including amounts, timestamps, payment method used, and transaction reference numbers. We do not store complete payment account credentials — see Section 5 for details.

2.4 Platform Usage Data

We automatically collect certain data about how you interact with the pak399 platform, including:

• IP address and approximate geolocation
• Device type, operating system, and browser
• Pages visited, game sessions, bet history, and session duration
• Login timestamps and Account activity logs

2.5 Communications Data

If you contact pak399 support via Live Chat, WhatsApp, Telegram, or email, we retain records of those communications for quality assurance, training, and dispute resolution purposes.

3 How We Use Your Data

pak399 uses the personal data we collect for the following purposes:

4 Legal Bases for Processing

pak399 processes personal data on the following legal bases:

• Contract performance: Processing necessary to provide the services you have signed up for, including account management, game access, and financial transactions.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering obligations, age verification requirements, and financial record-keeping obligations.
• Legitimate interests: Processing necessary for pak399's legitimate business interests, such as fraud prevention, platform security, and service improvement — provided these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for purposes where you have given specific, informed consent — primarily marketing communications. You may withdraw consent at any time without affecting prior processing.

5 Payment Data & PKR Transactions

All pak399 financial transactions are conducted in PKR through Approved Payment Methods: Easypaisa, JazzCash, Raast, and SadaPay. The specific handling of payment data for each method is as follows:

• Easypaisa & JazzCash: When you initiate a deposit or withdrawal via mobile wallet, pak399 records your registered mobile number, the transaction reference number, and the PKR amount. We do not store your wallet PIN, MPIN, or any authentication credentials.
• Raast: Raast bank transfer transactions are processed through your bank's own infrastructure. pak399 records the IBAN used, transaction reference, and amount for reconciliation purposes only.
• SadaPay: SadaPay transactions are handled via their secure API. pak399 records the transaction reference and amount; we do not retain SadaPay card or account numbers beyond what is strictly necessary for the transaction.

Payment data is retained for a minimum of five years from the date of the transaction to comply with financial record-keeping requirements. After this period, transaction records are anonymised.

6 Cookies & Tracking Technologies

pak399 uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and support fraud prevention. The types of cookies we use are:

• Strictly necessary cookies: Required for the platform to function — session management, login state, security tokens. These cannot be disabled without breaking core platform functionality.
• Performance cookies: Collect anonymised data about how players navigate the platform, which pages are visited most, and where errors occur. This data helps us improve the player experience.
• Functional cookies: Remember your preferences such as language settings, display options, and your most recently used payment method, so you do not have to re-enter them every session.
• Analytics cookies: Used by our analytics tools to understand aggregated usage trends. Data generated by these cookies does not identify you personally.

You can control non-essential cookies through your browser settings. Disabling cookies may affect your experience on certain parts of the pak399 platform. A cookie preference centre is accessible from the platform footer.

7 Third-Party Data Sharing

pak399 does not sell your personal data. We share data with third parties only in the following limited circumstances:

• Payment providers: Easypaisa, JazzCash, Raast, and SadaPay receive only the data strictly necessary to process your deposit or withdrawal transaction.
• Identity verification partners: Third-party KYC service providers who assist with document verification and age checks. These partners process data under strict confidentiality agreements.
• Gaming software providers: Providers of casino games and sports betting technology integrated into the pak399 platform may receive anonymised session data for game integrity and RNG auditing purposes.
• Fraud prevention and AML services: Specialist third parties who help us detect and prevent financial crime. Data shared for this purpose is the minimum required and is subject to data processing agreements.
• Legal and regulatory authorities: Where required by law, court order, or lawful regulatory request, pak399 will disclose personal data to competent authorities.
• Business successors: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the transaction, subject to equivalent privacy protections continuing to apply.

All third parties with whom pak399 shares personal data are required to handle that data in accordance with applicable data protection standards and their contractual obligations to pak399.

8 Data Retention

pak399 retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised:

• Account data: Retained for the duration of your Account and for five years following Account closure, to comply with anti-money laundering and financial record-keeping requirements.
• KYC documents: Retained for five years from the date of submission or from Account closure, whichever is later.
• Financial transaction records: Retained for five years from the date of each transaction.
• Communications records: Support chat logs and email correspondence are retained for up to two years, unless they relate to an open dispute or legal matter, in which case they are retained until the matter is resolved.
• Usage and analytics data: Aggregated and anonymised after 13 months; raw session logs are deleted within 24 months.
• Self-exclusion records: Retained indefinitely to prevent re-registration by excluded players, in the interest of responsible gaming.

9 Security Measures

pak399 employs a layered approach to data security, implementing technical and organisational measures appropriate to the nature and sensitivity of the data we process. Key security measures include:

• TLS encryption for all data transmitted between your device and the pak399 platform
• Encryption at rest for stored personal data, identity documents, and financial records
• Role-based access controls ensuring that only authorised personnel can access personal data
• Two-factor authentication for staff access to production systems containing player data
• Regular security testing, including penetration testing and vulnerability assessments
• Incident response procedures with defined notification timelines in the event of a data breach

Despite these measures, no internet-based system is entirely immune from security risks. pak399 cannot guarantee absolute security and encourages players to use strong, unique passwords and to keep their account credentials private.

10 Your Data Rights

As a pak399 player, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of all personal data pak399 holds about you. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor profile details can be updated directly in Account settings.
• Right to Erasure ("Right to Be Forgotten"): Subject to legal and regulatory retention obligations, you may request that pak399 delete your personal data. Note that data subject to mandatory financial record-keeping requirements cannot be deleted until the applicable retention period expires.
• Right to Restrict Processing: You may request that pak399 restrict the processing of your data in certain circumstances, such as while a dispute about its accuracy is being resolved.
• Right to Data Portability: You may request that pak399 provide your personal data in a structured, machine-readable format where this is technically feasible.
• Right to Object: You may object to pak399 processing your data based on legitimate interests, including for direct marketing purposes. You may opt out of marketing communications at any time without closing your Account.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

To exercise any of these rights, contact the pak399 privacy team via the support channels listed in Section 14. We may request identity verification before acting on your request to protect against unauthorised access to another player's data.

11 Responsible Gaming & Data

pak399 uses certain player data specifically to support responsible gaming obligations. This includes monitoring betting patterns and session behaviour to identify players who may be showing signs of problem gambling. Where such patterns are identified, pak399 may proactively contact the player to offer support resources or suggest the use of Responsible Gaming Tools available within the Account.

Self-exclusion requests and the associated player records are handled with particular sensitivity. Players who self-exclude are added to an internal exclusion register. This data is never used for any marketing purpose and is retained after Account closure solely to prevent re-registration during the exclusion period.

Processing player data for responsible gaming purposes is a legitimate and necessary function of the pak399 platform. Players who object to this form of data processing should note that it is integral to our responsible gaming obligations and cannot be opted out of while maintaining an active Account.

12 Children's Privacy

The pak399 platform is strictly for adults aged 18 and above. pak399 does not knowingly collect or process personal data from individuals under the age of 18. Age verification is a mandatory step in the Account registration and KYC process.

If pak399 becomes aware that personal data has been submitted by a minor, we will immediately suspend the associated Account, delete the personal data where legally permissible, and notify the individual. If you have reason to believe that a minor has registered a pak399 Account, please contact our support team immediately.

13 Changes to This Privacy Policy

pak399 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform functionality. When material changes are made, we will update the effective date at the top of this Policy and, where appropriate, notify registered players via email or in-platform messaging.

We encourage you to review this Policy periodically. Your continued use of the pak399 platform after a revised Policy has been published constitutes your acceptance of the updated terms, provided that where the changes require fresh consent (such as a new marketing use of your data), we will seek that consent separately.

14 Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how pak399 has handled your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 through the pak399 platform — ask to be connected to the privacy team
• WhatsApp & Telegram: Available 24/7 with average response times under 5 minutes
• Email: [email protected] (plain text — not a clickable link)

Privacy-related requests are treated with priority. For data access, correction, or deletion requests, please include your full name, registered email address, and a clear description of your request. We will acknowledge your request within 5 business days and provide a substantive response within 30calendar days.