Privacy Policy — How 29pkr Handles Your Personal Data

This Privacy Policy ("Policy") is issued by 29pkr (referred to herein as "29pkr", "we", "us" or "our") and governs the collection, processing, storage, use, disclosure and protection of personal data submitted to or collected by 29pkr through the website at https://29pkr.cam and all associated sub-domains, mobile interfaces and platform features (collectively, the "Platform").

29pkr is an English-language online sports betting and casino platform designed for users in Pakistan. All personal data is processed in accordance with the privacy and data protection standards applicable under the jurisdiction in which 29pkr holds its operating licence. Where users are located in Pakistan, 29pkr encourages them to review relevant provisions of the Prevention of Electronic Crimes Act 2016 (PECA) and any other applicable Pakistani data-related legislation, as these may govern their personal rights with respect to data.

This Policy forms part of the overall agreement between you and 29pkr, and should be read alongside our Terms & Conditions. By using the Platform, you acknowledge that you have read this Policy and understand how your personal information is handled.

The following terms carry the meanings assigned below throughout this Policy:

29pkr acts as the Data Controller in respect of all Personal Data collected through the Platform. This means that 29pkr determines the purposes for which your Personal Data is processed, the methods by which it is processed, and the safeguards applied to its storage and transmission.

Where 29pkr engages third-party service providers — such as payment processors, identity verification services, responsible gambling screening tools, customer support systems and analytics platforms — those providers act as Data Processors under binding contractual arrangements that specify the scope, purpose and security standards applicable to any data they handle on our behalf.

29pkr collects Personal Data across the following categories. We collect only what is necessary for the stated purposes:

29pkr collects Personal Data through the following mechanisms:

• Direct submission: Information you provide during registration, KYC verification, deposit/withdrawal transactions, support interactions and when updating account settings.
• Automated technical collection: Data collected automatically when you access the Platform — including IP address, device identifiers, browser type, session cookies and usage logs.
• Third-party identity verification: Where we engage identity verification service providers, they may supply us with a verification outcome and associated data fields following document submission.
• Payment processors: Transactional data passed back from payment processors confirming deposit credits, withdrawal completion or payment failures.
• Fraud and risk screening services: We may receive data flags from third-party risk screening tools that assist in detecting fraud, money laundering and responsible gambling risk indicators.
• Cookies and tracking technologies: As described in Section 11, we use cookies and similar technologies to collect session and behaviour data when you browse the Platform.

We process your Personal Data only where a lawful basis exists. The primary purposes and their corresponding legal bases are set out below:

• Account creation and management: Processing is necessary to perform our contract with you — i.e., to provide the Platform services you have registered to use.
• Identity verification and KYC: Processing is necessary to comply with legal and regulatory obligations applicable to the operator's licence, including anti-money laundering (AML) and counter-terrorism financing (CTF) requirements.
• Payment processing: Processing is necessary to perform our contractual obligations — accepting deposits and processing withdrawals in PKR via available methods.
• Fraud prevention and security: Processing is in our legitimate interests — and yours — to detect, investigate and prevent fraud, money laundering, account compromise and other prohibited conduct.
• Responsible gambling monitoring: Processing is in our legitimate interests and, in certain jurisdictions, a regulatory obligation — to identify and respond to indicators of problem gambling in compliance with our responsible gambling obligations.
• Platform improvement and analytics: Processing is in our legitimate interests to understand how the Platform is used and to improve product quality, usability and performance.
• Marketing communications: Processing is based on your consent, which you provide at the time of opt-in and may withdraw at any time. We do not send marketing communications without a valid consent record.
• Legal compliance and dispute resolution: Processing is necessary to comply with applicable legal obligations, including responding to lawful requests from regulatory or law enforcement authorities, and resolving disputes between us and users.

29pkr does not sell, rent or trade your Personal Data to any third party for commercial or marketing purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the specified purpose:

• Payment processors: To process deposits and withdrawals via your chosen payment method. These processors act as Data Processors under contract and are not permitted to use your data for their own purposes beyond the transaction.
• Identity verification providers: To conduct KYC checks. These providers process your identity documents for verification purposes only, under strict contractual confidentiality terms.
• Fraud and AML screening services: To screen transactions and account activity for indicators of fraud, money laundering or other prohibited conduct. These services process data flags and outcomes, not documents.
• Customer support systems: We may use third-party helpdesk or live chat platforms. Conversations with support staff may be stored on these systems. All systems used are bound by data processing agreements.
• Responsible gambling platforms: Where applicable, data may be shared with third-party responsible gambling support tools or self-exclusion registers where required by the operator's licence conditions.
• Regulatory and law enforcement authorities: Where required by applicable law or a binding legal order, we will disclose Personal Data to regulators, courts, law enforcement agencies or other public authorities. We will, where permitted, notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of the business, Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

29pkr operates under international licensing and may process or store Personal Data outside of Pakistan. Where your Personal Data is transferred to jurisdictions outside your country of residence, we take steps to ensure that appropriate safeguards are in place to protect your data in a manner consistent with the standards described in this Policy.

These safeguards may include contractual protections between 29pkr and data processors in other jurisdictions, encryption of data in transit and at rest, and access controls limiting who within those jurisdictions can access your information.

By using the Platform and submitting your Personal Data, you acknowledge that your data may be transferred to and processed in countries outside Pakistan, which may have different data protection laws. If you have concerns about international data transfers, please contact us using the details in Section 16.

We retain Personal Data only for as long as is necessary to fulfil the purpose for which it was collected or as required by applicable law or regulation. The following retention principles apply:

• Active account data: Retained for the duration of your Account plus any legally required post-closure retention period (typically five years from account closure under AML/CTF obligations).
• Transaction records: Financial and transactional records are retained for a minimum of five years following the transaction date, in accordance with standard anti-money laundering regulatory requirements.
• KYC documentation: Identity verification documents are retained for the duration of the account relationship and for a minimum of five years following account closure, as required by the operator's licence obligations.
• Support communications: Retained for up to three years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of the lawful basis for processing.
• Technical and usage data: Typically retained in identifiable form for up to 24 months, after which it may be anonymised and retained in aggregate form for analytical purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised such that it can no longer be linked to an identifiable individual.

29pkr implements a range of technical and organisational measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, loss or destruction. These measures include, but are not limited to:

• TLS (Transport Layer Security) encryption for all data transmitted between your browser and the Platform.
• Encryption of sensitive data fields (including financial data and identity documents) at rest within our databases.
• Role-based access controls limiting which internal personnel can access different categories of Personal Data, on a strict need-to-know basis.
• Regular security assessments and vulnerability testing of the Platform infrastructure.
• Two-factor authentication options for user accounts to reduce the risk of unauthorised account access.
• Incident response procedures to detect, investigate and remediate any suspected data security breach within required timeframes.

Notwithstanding these measures, no internet transmission or electronic storage system is completely secure. We cannot guarantee absolute security, and we encourage you to use strong, unique passwords for your Account and to enable two-factor authentication where available.

The Platform uses cookies and similar tracking technologies (such as web beacons, pixel tags and local storage objects) to operate core functionality, improve user experience and collect usage analytics. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function — maintaining your session, authentication state and security tokens. These cannot be disabled without breaking core functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, and to provide enhanced features. Disabling these may affect your experience.
• Analytics Cookies: Used to understand how users interact with the Platform — pages visited, time spent, error occurrences. Data collected is aggregated and used to improve the Platform. These may be operated by trusted third-party analytics providers.
• Marketing / Preference Cookies: Used only where you have provided consent, to deliver relevant promotional content based on your Platform interaction history. You may withdraw consent at any time via your browser settings or our cookie preference tool.

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse, accept or delete cookies. Refusing strictly necessary cookies will impair your ability to use the Platform. Refusing other categories will not prevent access but may affect functionality and relevance of content shown to you.

Subject to applicable law and the legitimate purposes for which your data is held, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact us using the details in Section 16. We will respond within a reasonable timeframe and at no cost to you in ordinary circumstances.

The 29pkr Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the operator's licence jurisdiction or the user's own local laws. We do not knowingly collect Personal Data from individuals under the required minimum age.

If we become aware that an individual under the minimum age has registered an Account or submitted Personal Data to the Platform, we will immediately suspend the Account, delete any associated Personal Data, and withhold any funds pending investigation and, where applicable, return them to the original payment source.

If you believe that a minor has submitted Personal Data to 29pkr, please contact us immediately at the address in Section 16. We take underage access extremely seriously and will act promptly on any notification received.

The Platform may contain references to or functionality powered by third-party services — including payment processors, identity verification providers, live game studios and analytics tools. 29pkr is not responsible for the privacy practices of any third party, and this Policy does not govern how third parties process data they collect independently.

Where the Platform is accessed via third-party devices, applications or browser extensions that collect their own data, those third parties' privacy policies apply to their data collection. We recommend reviewing the privacy documentation of any third-party service before using it in connection with the Platform.

29pkr reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements or Platform features. The "Effective Date" at the top of this page reflects the date of the most recent revision.

Where changes are material — that is, where they meaningfully alter how we use your data or reduce your rights in relation to it — we will provide advance notice via email to the address registered on your Account, or via a prominent notice on the Platform, at least fourteen (14) days before the changes take effect.

Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with any change, you may close your Account and request deletion of your Personal Data in accordance with Section 12.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way 29pkr processes your Personal Data, or if you wish to exercise any of the rights described in Section 12, please contact our support team using the details below. All privacy-related enquiries are handled with confidentiality.

For matters relating to cookies, marketing preferences or communication opt-outs, you may manage these directly from within your Account settings or by contacting us at the address above.