pk21 Privacy Policy

pk21 ("we", "us", "our") is the data controller responsible for the personal information collected from players who register and use the pk21 online gaming platform, accessible at https://pk21.app (the "Platform"). As data controller, pk21 determines the purposes for which and the means by which your personal data is processed.

This Privacy Policy applies to all personal data collected through: the pk21 website and any mobile-optimised version thereof; your pk21 player account and all activity conducted through it; communications between you and pk21 support staff via live chat, email, or any other channel; and any promotional or marketing communications you receive from pk21 where you have provided consent.

If you have any questions about how pk21 processes your personal data, or if you wish to exercise any of your data subject rights as described in Section 10, please contact our data protection team via live chat, which is available 24 hours a day, 7 days a week.

pk21 collects the following categories of personal data from players. The specific data points collected will depend on how you interact with the Platform and the stage of your account lifecycle.

pk21 does not collect or process any special categories of sensitive personal data (such as health data, biometric data, or racial/ethnic origin data) other than what may be incidentally visible on a CNIC document submitted for KYC purposes. Such incidental data is not actively processed or recorded beyond the verification purpose.

pk21 collects personal data through the following channels and mechanisms:

3.1 Direct Collection

The majority of the personal data pk21 holds about you is information you provide directly. This includes data entered during the account registration process, information submitted as part of the KYC verification process, payment details provided when making deposits or requesting withdrawals, and information shared with our customer support team during live chat or email interactions.

3.2 Automated Technical Collection

When you visit and use the pk21 Platform, certain technical data is collected automatically through your browser and our server infrastructure. This includes your IP address, the pages you visit, your session duration, device identifiers, browser type and version, and operating system information. This data is collected using server logs, session cookies, and similar technologies as described in Section 7 of this Privacy Policy.

3.3 Third-Party Sources

In limited circumstances, pk21 may receive personal data about you from authorised third-party sources. These include identity verification service providers used during the KYC process, fraud detection and anti-money laundering screening services, and payment processors such as JazzCash, EasyPaisa, Raast, and 1LINK who confirm transaction completion. All third-party data sources used by pk21 are contractually required to confirm that they have a lawful basis for sharing data with us.

pk21 processes your personal data only where we have a valid legal basis for doing so. The primary purposes for which pk21 processes personal data, along with the corresponding legal basis, are set out below:

4.1 Account Registration & Management

We process your identity and contact data to create and manage your pk21 player account, authenticate your identity at login, and communicate with you about your account status. Legal basis: Performance of a contract — this processing is necessary to provide you with access to the pk21 Platform in accordance with our Terms and Conditions.

4.2 KYC & Age Verification

We process your identity documents and date of birth to verify that you are aged 21 or above and to confirm your identity in accordance with our anti-money laundering obligations. Legal basis: Legal obligation — pk21 is required to conduct customer due diligence under applicable AML regulations and our operating licence conditions.

4.3 Payment Processing

We process your financial data to facilitate deposits and withdrawals in PKR through JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, GrabPay, and Cash OTC. Legal basis: Performance of a contract — processing payment data is essential for the delivery of the gaming service you have contracted with us to receive.

4.4 Responsible Gaming & Player Protection

We process your gaming activity data and account history to monitor for signs of problem gambling, enforce self-imposed responsible gaming limits, and identify players who may require support. Legal basis: Legitimate interests — pk21 has a legitimate and regulatory interest in protecting the welfare of its players.

4.5 Fraud Prevention & Security

We process technical data, transaction records, and account behaviour data to detect and prevent fraud, collusion, bonus abuse, money laundering, and other prohibited activities. Legal basis: Legitimate interests and legal obligation — protecting the integrity of the Platform and complying with AML obligations.

4.6 Marketing Communications

Where you have opted in to receive promotional communications, we process your contact data and gaming preferences to send you personalised offers, bonus notifications, and news about pk21 promotions. Legal basis: Consent — you can withdraw this consent at any time through your account settings or by contacting support.

pk21 does not sell, rent, or trade your personal data. We share your data only in the following clearly defined circumstances:

5.1 Service Providers

pk21 engages regulated third-party service providers to support the operation of the Platform. These include KYC and identity verification providers, payment processing networks (JazzCash, EasyPaisa, bank transfer gateways), fraud detection services, IT infrastructure and cloud hosting providers, and customer support platform operators. All service providers are bound by strict data processing agreements that prohibit them from using your data for any purpose other than delivering the specific service to pk21.

5.2 Regulatory & Law Enforcement Authorities

pk21 may be required by applicable law, court order, or regulatory directive to disclose your personal data to competent authorities. This includes disclosures to financial intelligence units in connection with suspected money laundering, disclosures ordered by a court of competent jurisdiction, and reports made to sports integrity bodies in connection with match-fixing investigations. pk21 will always seek legal advice before making discretionary disclosures of this nature and will notify you where legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of substantially all of pk21's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights in relation to your data will be maintained.

Given the sensitive nature of financial information, pk21 applies additional safeguards to payment-related personal data beyond our standard data protection measures.

pk21 does not store full bank account numbers or complete JazzCash/EasyPaisa wallet credentials on its own servers. Payment processing is handled by PCI DSS-compliant payment service providers. pk21 retains only a tokenised reference to your payment method, your transaction history (amounts, dates, methods), and the minimum financial data required for AML record-keeping obligations.

All deposit and withdrawal transactions are processed exclusively in Pakistani Rupees (PKR). Financial transaction records are retained for a minimum of 5 years in line with standard AML record-keeping requirements. These records may be disclosed to financial regulatory authorities upon lawful request.

pk21 uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience on the Platform. The following types of cookies are used:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in and using the pk21 Platform. Analytical and marketing cookies can be enabled or disabled at any time through your pk21 account settings or by contacting our support team.

pk21 retains personal data only for as long as is necessary for the purposes for which it was collected, or for as long as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

• Account & Identity Data: Retained for the duration of your active account, plus a minimum of 5 years following account closure, in line with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming Activity Data: Retained for the duration of your active account, plus 2 years following account closure, for responsible gaming, dispute resolution, and fraud prevention purposes.
• Customer Support Communications: Retained for 3 years from the date of each interaction.
• Marketing Preferences: Retained until you withdraw consent or request deletion, after which suppression records are maintained to honour your opt-out.
• Technical & Log Data: Retained for 12 months from the date of collection.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

pk21 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• Encryption in Transit: All data transmitted between your device and pk21 servers is encrypted using TLS 1.3 protocol. Our domain enforces HTTPS at all times.
• Encryption at Rest: Sensitive personal data stored on pk21 servers is encrypted using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. pk21 staff are granted the minimum level of access required to perform their role and all access events are logged and audited.
• Multi-Factor Authentication: Administrative access to pk21 systems that contain personal data requires multi-factor authentication.
• Penetration Testing: pk21 conducts regular third-party security assessments and penetration tests to identify and remediate vulnerabilities in our infrastructure.
• Incident Response: pk21 maintains a documented data breach response procedure. In the event of a security incident that affects your personal data, we will notify you and any applicable regulatory authority within the timeframes required by applicable law.

As a pk21 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact our support team via live chat or the email address in Section 14.

10.1 Right of Access

You have the right to request a copy of all personal data pk21 holds about you. We will provide this in a structured, commonly used format within 10 business days of receiving a verified request.

10.2 Right to Rectification

If any personal data pk21 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Identity and contact data corrections may require re-verification of your identity documents.

10.3 Right to Erasure

You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you have withdrawn consent and there is no other legal basis for processing. This right is subject to pk21's legal obligation to retain certain data for AML and regulatory compliance purposes, which will take precedence where applicable.

10.4 Right to Restrict Processing

You may request that pk21 restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is being contested or while an objection to processing is being assessed.

10.5 Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to request that it be transmitted to another data controller where technically feasible.

10.6 Right to Object

You have the right to object to processing of your personal data where pk21 relies on legitimate interests as the legal basis. You also have an absolute right to object to the use of your data for direct marketing purposes at any time.

pk21 operates a strict 21+ age policy. The Platform is not intended for, and must not be used by, any person under the age of 21. pk21 does not knowingly collect personal data from individuals under the age of 21.

As part of the mandatory KYC verification process, all pk21 players are required to submit a valid CNIC which confirms their date of birth. Any account where the account holder is found to be under 21 years of age will be immediately suspended, all funds held in the account will be returned to the payment method of origin (minus any bonus funds), and all personal data associated with the account will be deleted in line with our data retention policy.

If you are a parent or guardian and believe that a minor has registered a pk21 account using false age information, please contact our support team immediately via live chat. pk21 will investigate all such reports promptly and take appropriate action.

pk21 sends promotional communications including bonus offers, PSL and cricket betting promotions, new game announcements, and platform updates to players who have opted in to receive such communications. Marketing communications are sent via email and/or SMS to your registered contact details.

You can manage your marketing preferences at any time through the following methods:

• Log in to your pk21 account and update your communication preferences in the account settings section.
• Click the unsubscribe link included in any marketing email you receive from pk21.
• Contact our support team via live chat and request that your marketing preferences be updated.

Opting out of marketing communications will not affect your ability to receive service-related communications from pk21. Transactional emails — such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts — are not marketing communications and will continue to be sent regardless of your marketing preferences as they are necessary for the operation of your account.

pk21 will action all marketing opt-out requests within 5 business days. Due to the nature of email delivery systems, you may receive one or two further communications after submitting your opt-out request before it takes full effect.

pk21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform features. The effective date at the top of this page will always reflect the date of the most recent revision.

Where changes to this Privacy Policy are material — meaning they substantially affect how your personal data is processed or the rights available to you — pk21 will notify registered players via email to their registered address and/or via a prominent notice on the Platform at least 14 days before the changes take effect. Non-material changes such as typographical corrections or clarifications that do not alter the substance of our data processing practices may be made without advance notice.

Your continued use of the pk21 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes to this Privacy Policy, you should stop using the Platform and request account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how pk21 processes your personal data, please contact our data protection team through the following channels:

• Live Chat: Available 24/7 via the pk21 Platform — the fastest way to reach our support team for any privacy-related enquiry.
• Email: [email protected] — for formal data subject rights requests or written privacy complaints.

pk21 will acknowledge all privacy-related enquiries within 2 business days and aims to resolve all complaints within 20 business days. For complex matters, we may require additional time and will keep you informed of progress throughout.

If you are not satisfied with pk21's handling of your privacy complaint after following our internal complaints process, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances.