pk22 Privacy Policy — How We Collect, Use & Protect Your Personal Data

1. Introduction & Scope

This Privacy Policy ("Policy") is published by pk22 ("pk22", "we", "us", "our") and applies to all personal data collected and processed in connection with the pk22 online gaming platform accessible at pk22.bio, including all associated web pages, services, Gaming Services, account management functions, payment processing operations, and customer support interactions.

This Policy applies to all individuals who interact with the pk22 platform in any capacity, including registered account holders, persons who have submitted a registration application, and individuals who contact pk22 support without holding an active account. It applies regardless of the device used to access the platform — mobile phone, tablet, or desktop computer — and regardless of the specific game or service used on the platform.

This Policy is incorporated into and should be read alongside the pk22 Terms & Conditions and Responsible Gaming Policy. In the event of any conflict between this Policy and the Terms & Conditions regarding the processing of personal data, this Policy shall prevail.

2. Data Controller Identity

pk22 is the data controller in respect of all personal data processed under this Policy. As data controller, pk22 determines the purposes for which personal data is collected and the means by which it is processed. pk22 operates under an international gaming licence, and the data protection obligations applicable to pk22 include both the requirements of that licence and the data protection frameworks applicable in the jurisdictions from which pk22 accepts players.

For all data protection enquiries, rights requests, or complaints relating to the processing of your personal data by pk22, please contact the Data Protection team via:

• Live Chat: Available 24/7 within the pk22 platform — the fastest route for urgent data-related queries.
• Email (plain text only — not a link): [email protected] — include "Data Protection Request" in the subject line for prioritised routing.

3. Data We Collect

pk22 collects personal data from three primary sources: information you provide directly, information generated automatically by your use of the platform, and information received from third-party service providers.

Information you provide directly:

• Registration data: Your Pakistani mobile number and your chosen password at account creation. Additional profile information (display name, preferred language) if voluntarily provided.
• KYC documents: A clear photograph or scan of your valid National Identity Card (CNIC) — both sides — provided when you submit your first withdrawal request. We may also request a selfie for identity matching in cases of heightened fraud risk.
• Payment information: Your JazzCash or EasyPaisa account number, bank account details (IBAN format for HBL, UBL, Meezan Bank transfers), or crypto wallet address (for USDT deposits). Note: full card numbers are never stored by pk22 — payment data is tokenised and processed via our PCI-DSS compliant payment partners.
• Support communications: The content of any message, enquiry, or complaint submitted via live chat or email, together with any attachments or screenshots provided as part of a support interaction.
• Responsible gaming data: Self-set deposit limits, session timer preferences, cooling-off requests, and self-exclusion submissions.

Information collected automatically:

• Technical and device data: Your IP address, device type, operating system, browser version, and approximate geographic location derived from IP address.
• Usage and gaming data: Complete records of all game sessions, including game titles played, stake amounts, outcomes, session duration, cash-out times (for crash games), and bonus usage.
• Session metadata: Login timestamps, logout timestamps, session duration, and page navigation patterns within the platform.
• Cookie and local storage data: As described in Section 7 of this Policy.

Information received from third parties:

• Payment providers: Transaction confirmation data, payment status updates, and — where required for AML purposes — enhanced due diligence information from payment processing partners.
• Fraud prevention databases: Risk scores, flagging information, and cross-platform account linkage data from fraud prevention services with which pk22 has data-sharing agreements.

4. Legal Basis for Processing

pk22 processes your personal data only where it has a valid legal basis for doing so. The legal bases upon which pk22 relies are:

• Performance of a contract: Processing that is necessary to perform the services you have requested under the Terms & Conditions — including creating and maintaining your account, processing deposits and withdrawals, settling bets, and providing customer support.
• Compliance with a legal obligation: Processing required to comply with obligations under our international gaming licence, anti-money laundering (AML) regulations, and counter-terrorism financing (CTF) obligations — including KYC verification and financial transaction record-keeping.
• Legitimate interests: Processing carried out to pursue the legitimate interests of pk22 or third parties, where those interests are not overridden by your data protection rights — including fraud prevention, platform security, abuse detection, and responsible gaming monitoring. Where pk22 relies on legitimate interests, we have conducted an assessment confirming that the processing is necessary, proportionate, and does not prejudice your fundamental rights.
• Consent: Where processing is not covered by one of the bases above — particularly in relation to non-essential cookies and direct marketing communications — pk22 will seek your explicit consent and will not process the relevant data without it. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. How We Use Your Data

pk22 uses the personal data it holds for the following purposes, each of which is tied to the legal bases described in Section 4:

• Account management: Creating, maintaining, and securing your pk22 account, including authenticating your identity at each login and enabling account recovery where requested.
• Service delivery: Operating all Gaming Services available on the pk22 platform, settling bets and game outcomes, processing bonus awards, and maintaining your account balance.
• Payment processing: Processing deposit requests via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT; processing withdrawal requests to your verified payment method; and maintaining financial records required under AML obligations.
• Identity verification: Conducting KYC verification to confirm your identity, age (21+ requirement), and the legitimacy of your payment methods before processing withdrawal requests.
• Fraud and AML prevention: Monitoring account activity, deposit and withdrawal patterns, and device/IP data to detect and investigate potential fraud, money laundering, multi-accounting, and bonus abuse.
• Responsible gaming: Monitoring gaming patterns to identify indicators of problem gambling behaviour; enforcing self-set deposit limits, cooling-off periods, and self-exclusion requests; and proactively reaching out to players who may be exhibiting signs of gambling harm.
• Customer support: Responding to enquiries, complaints, and disputes; maintaining records of support interactions; and improving the quality of support services.
• Platform improvement: Analysing aggregated, anonymised usage data to identify areas for improvement in platform performance, game selection, and user experience.
• Legal and regulatory compliance: Meeting all obligations under pk22's international gaming licence, applicable data protection laws, and requirements imposed by regulatory authorities, law enforcement agencies, or courts of competent jurisdiction.

6. Data Sharing & Third Parties

pk22 does not sell, rent, or trade your personal data. Personal data is shared with third parties only in the circumstances described below, and only to the extent necessary for the specific purpose of sharing.

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and cryptocurrency processing partners receive the transaction data necessary to process your deposits and withdrawals. These parties act as independent data controllers for their own processing purposes.
• KYC and identity verification services: Third-party identity verification providers may receive copies of your identity documents and biometric data (selfie photograph) to confirm your identity and age. These providers are bound by data processing agreements with pk22 and process data only for the stated purpose.
• Fraud prevention databases: pk22 participates in industry fraud prevention networks. Data about accounts confirmed to be engaged in fraudulent activity, multi-accounting, or AML violations may be shared with these networks to protect other licensed operators and their players.
• Gaming software providers: The providers of specific games available on the pk22 platform may receive the game session data necessary to operate and settle game outcomes. These providers are bound by data processing agreements.
• Regulatory and law enforcement authorities: pk22 will share personal data with its gaming licensing authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required to do so by law, regulation, court order, or licence condition.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of pk22's assets, personal data held by pk22 may form part of the transferred assets. Affected users will be notified before their data is transferred and becomes subject to a different privacy policy.

7. Cookies & Tracking Technologies

pk22 uses cookies and similar local storage technologies to operate the platform effectively. A cookie is a small data file placed on your device by the platform when you access it. The following categories of cookies are used by pk22:

• Essential cookies: Strictly necessary for the platform to function — including session authentication cookies that keep you logged in between pages, and security tokens that protect against CSRF attacks. These cookies cannot be disabled without breaking platform functionality.
• Functional cookies: Remember your preferences within the platform — such as your preferred game lobby view, language setting, and notification preferences. These cookies are not strictly necessary but enhance your experience. They are enabled by default but can be disabled in your browser settings.
• Analytics cookies: Used to collect anonymised data on how players navigate the platform — which sections are visited, where drop-off occurs, and how features are used. This data is used exclusively to improve the pk22 platform. Analytics cookies are only set with your consent.
• Security cookies: Used to detect and prevent fraudulent activity, including bot detection, device fingerprinting for duplicate account identification, and anomalous session behaviour monitoring.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in or using the pk22 platform. Disabling analytics and functional cookies will not affect your ability to use core platform features but may degrade your experience. Browser-level cookie management is available in all major browsers including Chrome, Safari, Firefox, and Edge — the settings are typically found under Privacy & Security or Site Settings.

8. Data Security

pk22 implements a comprehensive range of technical and organisational security measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and pk22 servers is encrypted using 256-bit TLS — the same encryption standard used by Pakistan's major banks for internet banking services.
• Data encryption at rest: Sensitive data categories — including identity documents, payment method details, and password hashes — are encrypted in pk22's databases using industry-standard encryption algorithms.
• Access controls: Personal data is accessible only to pk22 staff and systems with a legitimate need to access it for the performance of their duties. Access is governed by role-based access control policies and is logged and audited.
• Penetration testing: pk22's platform and infrastructure are subject to regular independent security penetration tests. Identified vulnerabilities are remediated on a risk-prioritised basis.
• Two-factor authentication: pk22 account holders are encouraged to enable SMS OTP-based two-factor authentication to add an additional layer of protection against unauthorised account access.

Despite these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. If pk22 becomes aware of a security breach that has compromised the personal data of account holders, we will notify affected individuals and the relevant regulatory authority in accordance with applicable legal requirements.

9. Data Retention

pk22 retains personal data only for as long as is necessary for the purposes set out in this Policy and to comply with applicable legal and regulatory obligations. The retention periods applicable to each data category are summarised in the table at the top of this page and elaborated below:

• Account and registration data: Retained for the duration of your active account plus a period of five (5) years following the date of account closure. This retention period is required to enable investigation and resolution of disputes, chargebacks, or regulatory enquiries that may arise after account closure.
• KYC and identity documents: Retained for a minimum of five (5) years post-account closure, as required by anti-money laundering regulations applicable under pk22's gaming licence.
• Financial transaction records: Retained for a minimum of seven (7) years, in compliance with AML record-keeping obligations applicable to licensed gaming operators.
• Gaming activity logs: Retained for a minimum of seven (7) years from the date of each game session, to comply with gaming licence obligations regarding game outcome records and to enable resolution of player disputes.
• Support and communication records: Retained for a period of three (3) years from the date of the last communication in a given support thread.
• Device and technical data: Retained for a period of two (2) years from collection, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Where anonymisation is applied, the resulting data no longer constitutes personal data and may be retained indefinitely for statistical and analytical purposes.

10. Your Data Rights

Subject to applicable law and the conditions described below, you have the following rights in relation to the personal data that pk22 holds about you. All rights requests should be submitted to the pk22 Data Protection team via live chat or at [email protected].

pk22 will respond to all verifiable data rights requests within thirty (30) days of receipt. In cases of complexity or volume, this period may be extended by a further sixty (60) days — you will be notified of any such extension within the initial 30-day period. pk22 may require proof of identity before processing a rights request to ensure that personal data is not disclosed to an unauthorised third party.

11. Children & Minors

pk22 actively enforces the 21+ age restriction through CNIC-based identity verification conducted as part of the KYC process before any withdrawal is processed. Registration attempts that cannot be verified as belonging to an adult aged 21 or over will be declined and the associated data will be deleted.

12. International Data Transfers

As a licensed online gaming operator serving Pakistani players, pk22 operates server infrastructure and engages third-party service providers in multiple jurisdictions. This means that your personal data may be transferred to, stored in, and processed in countries outside Pakistan. In all such cases, pk22 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy.

Safeguards employed by pk22 for international data transfers include:

• Data processing agreements with all third-party processors that include contractual data protection obligations consistent with international best practice;
• Transfer impact assessments for transfers to jurisdictions without broadly equivalent data protection frameworks;
• Technical measures including encryption and pseudonymisation to reduce the risk associated with international data flows.

13. Marketing Communications

pk22 may send you marketing communications about promotions, bonuses, new games, and other platform news via SMS or in-platform notifications. These communications are sent only with your consent, which you provide during registration or subsequently through Account Settings → Notifications.

You may withdraw consent to marketing communications at any time by:

• Updating your notification preferences in Account Settings → Notifications within the pk22 platform;
• Contacting pk22 support via live chat or at [email protected] and requesting that marketing communications be stopped.

Withdrawal of consent to marketing communications will not affect your ability to receive essential service communications — such as deposit confirmations, withdrawal notifications, account security alerts, and responsible gaming notifications. These communications are not marketing and will continue to be sent as part of the platform's operational obligation to keep you informed about your account.

14. Changes to This Privacy Policy

pk22 reviews this Privacy Policy regularly and may update it to reflect changes in applicable law, our processing activities, or the services we offer. Where changes are material — meaning they affect your rights or how we use your personal data in a significant way — we will provide at least seven (7) days' advance notice through the platform's in-app notification system and, where we hold a verified email or mobile number for you, via direct notification to that contact.

Minor changes — such as corrections of typographical errors or clarifications that do not alter the substance of the Policy — may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision, regardless of whether the change was material or minor.

Your continued use of the pk22 platform following the publication of any updated Policy constitutes your acceptance of the changes. If you do not agree with a material change, you may close your account before the effective date of the change. Your personal data will be handled under the Policy in force at the time of processing for historical transactions.

15. Contact & Complaints

For all privacy-related enquiries, data rights requests, or complaints regarding the processing of your personal data by pk22, please contact the Data Protection team through one of the following channels:

• Live Chat: Available 24/7 within the pk22 platform. Mention "Data Protection" or "Privacy Request" at the start of your message for priority routing to the relevant team.
• Email (plain text — not a clickable link): [email protected] — include "Privacy Policy Request" in the subject line. Target response time: within 30 days for data rights requests.

If you are not satisfied with pk22's response to a privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. pk22 will cooperate fully with any such supervisory authority investigation.

This Privacy Policy was last reviewed and updated on 1 January 2026. Document version: 2.4.