pk804 Privacy Policy —
How We Handle Your Personal Data

This Privacy Policy applies to all personal information collected, processed, stored, or transmitted by pk804 in connection with the operation of its online casino, sportsbook, live dealer, and related digital services available at pk804.org and any associated platforms operated under the pk804 brand.

This Policy applies to all registered members, visitors, and prospective members who interact with pk804's website, mobile platform, customer support services, payment processing systems, or marketing communications. It covers data collected directly from you, data collected automatically through your use of the pk804 platform, and data received from verified third-party sources as part of our regulatory compliance obligations.

pk804 is committed to handling personal data in compliance with applicable international data protection standards and the data governance requirements of our operating licence. Where Pakistani members' data is concerned, pk804 applies the same protections as would be required under internationally recognised privacy frameworks, including principles of data minimisation, purpose limitation, and storage limitation.

For the purposes of this Privacy Policy, pk804 acts as the data controller in respect of personal data collected from members and visitors to the pk804 platform. As data controller, pk804 determines the purposes and means of processing your personal information in connection with the provision of its gaming and wagering services.

pk804 processes personal data under the authority of its international gaming operating licence, which mandates specific data collection and retention obligations as a condition of lawful platform operation. These obligations include identity verification (KYC), anti-money laundering (AML) checks, responsible gaming monitoring, and financial transaction auditing.

pk804 collects personal data across the following categories. We collect only what is necessary for the specific purpose stated and do not retain data beyond its required purpose:

pk804 collects personal data through the following methods:

• Direct submission: Information you provide when registering for a pk804 account, completing KYC verification, making deposits or withdrawals, contacting support, or responding to surveys.
• Automated platform collection: Technical and behavioural data collected automatically as you navigate and use the pk804 platform, including device identifiers, IP geolocation, and session activity logs.
• Payment processor data: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank during deposit and withdrawal processing. pk804 does not receive or store full bank account credentials — only transaction reference identifiers.
• Identity verification services: Confirmation data returned by third-party KYC verification partners used to validate CNIC document authenticity. These partners are bound by confidentiality agreements and data processing restrictions.
• Cookies and tracking technologies: Session cookies, preference cookies, and analytical tracking tools described further in Section 9 of this Policy.

pk804 processes your personal data only for specific, documented purposes. Each processing activity has a corresponding legal basis as follows:

• Account creation and service delivery: Processing necessary for the performance of the membership agreement between you and pk804. Without this processing, pk804 cannot provide you with account access or gaming services.
• Identity verification and KYC: Legal obligation under pk804's international gaming licence. Mandatory 21+ age verification and CNIC-based identity confirmation are non-negotiable regulatory requirements.
• Payment processing: Necessary for contract performance. Your financial data is processed to execute deposits, withdrawals, and bonus payments as agreed in the pk804 Terms and Conditions.
• Anti-money laundering compliance: Legal obligation. pk804 is required to monitor transaction patterns, maintain financial records, and in certain circumstances report suspicious activity to relevant regulatory bodies.
• Responsible gaming monitoring: Legitimate interest and legal obligation. pk804 analyses gameplay and wagering patterns to identify potential indicators of problem gambling behaviour and to fulfil responsible gaming obligations under its operating licence.
• Customer support: Legitimate interest. Communications data from support interactions is retained to facilitate effective resolution of queries and to maintain a record of member communication history.
• Platform security and fraud prevention: Legitimate interest. Technical data including IP addresses and session logs is processed to detect, investigate, and prevent fraudulent account activity, multi-accounting, and bonus abuse.
• Marketing communications: Consent. Where you have opted in to receive promotional communications from pk804, your contact data is used for this purpose. You may withdraw consent at any time through your account settings.

pk804 does not sell, rent, or trade personal data to third parties for their own commercial or marketing purposes. Data sharing with third parties occurs only in the following specific circumstances, and only to the extent strictly necessary:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction data necessary to process your deposits and withdrawals. These parties process your financial data independently under their own terms and privacy policies.
• KYC / identity verification partners: Third-party CNIC verification services receive document images and extracted identity data solely for the purpose of verifying document authenticity. These partners are contractually prohibited from retaining or reusing this data.
• Game content providers: Software developers whose games appear on the pk804 platform may receive anonymised session and wagering data for technical performance monitoring. No personally identifiable information is shared with game providers.
• Regulatory and licensing authorities: pk804's international licensing authority may require access to specific member records as part of regulatory audit, compliance review, or investigation processes. Such disclosures are made pursuant to legal obligation.
• Law enforcement and legal process: pk804 will disclose personal data to law enforcement or judicial authorities where compelled to do so by a valid legal order, warrant, or regulatory direction. pk804 will notify affected members of such disclosures where legally permissible.
• Professional advisors: Legal, accounting, and compliance advisors engaged by pk804 may have access to personal data on a strictly need-to-know basis, under professional confidentiality obligations.

pk804 retains personal data for the period necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods imposed by our licensing and regulatory obligations:

• Identity and KYC documentation: Minimum 5 years following account closure. This retention period is mandated by anti-money laundering regulatory requirements applicable to licensed gaming operators.
• Financial transaction records: Minimum 5 years from the date of each transaction. This covers all deposits, withdrawals, bonus transactions, and wagering records.
• Gameplay and session records: Minimum 3 years from the date of the session, retained for responsible gaming monitoring and dispute resolution purposes.
• Customer support communications: 2 years from the date of last interaction, or longer where the communication relates to a formal complaint, dispute, or regulatory matter.
• Marketing consent records: Retained for the duration of active consent plus 1 year following withdrawal of consent, to evidence compliance with consent-based marketing obligations.

Following the expiry of applicable retention periods, personal data is permanently deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

pk804 implements a multi-layered data security framework to protect personal information against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational security measures include:

• End-to-end SSL/TLS encryption for all data transmitted between your device and pk804's servers
• AES-256 encryption for personal and financial data stored in pk804's databases
• Role-based access controls ensuring that pk804 staff can only access member data necessary for their specific job function
• Multi-factor authentication requirements for all pk804 staff accessing systems that contain personal data
• Regular independent security audits and penetration testing of pk804's platform infrastructure
• Intrusion detection systems and real-time anomaly monitoring for all database activity
• Segregated storage architecture preventing commingling of player data with operational system data

In the event of a personal data breach that poses a risk to member rights, pk804 will notify affected members and the relevant regulatory authority within the timeframe required under applicable data protection obligations. Notification will include the nature of the breach, categories of data affected, likely consequences, and measures taken to address the incident.

pk804 uses cookies and similar tracking technologies to operate its platform effectively, personalise your experience, and fulfil regulatory session monitoring obligations. The following categories of cookies are used:

• Strictly necessary cookies: Essential for platform functionality including session authentication, security token management, and responsible gaming session timers. These cannot be disabled without impairing platform operation.
• Functional cookies: Store your preferences such as language settings, display preferences, and game lobby layout choices. These improve platform usability but are not essential.
• Analytical cookies: Collect anonymised data about platform usage patterns — pages visited, features used, session duration — to help pk804 improve its services. No personally identifiable information is collected through analytical cookies.
• Session security cookies: Used to detect and prevent session hijacking, cross-site request forgery, and other session-based security threats. These are mandatory for account security.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the pk804 platform. Disabling functional or analytical cookies will not prevent platform access but may affect personalisation features.

As a pk804 member whose personal data is processed under this Policy, you hold the following rights regarding your personal information. Requests to exercise any of these rights should be directed to pk804's Privacy Officer at the contact details in Section 14:

• Right of Access: You may request confirmation of whether pk804 holds personal data about you, and a copy of that data in a readable format, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held by pk804. Certain data corrections may require supporting documentation.
• Right to Erasure: You may request deletion of personal data held by pk804, subject to overriding retention obligations imposed by our licensing authority. Data subject to mandatory regulatory retention cannot be deleted until the applicable retention period expires.
• Right to Restrict Processing: In certain circumstances, you may request that pk804 temporarily restrict the processing of your data while a dispute about accuracy or lawfulness is resolved.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest grounds, subject to pk804's legal obligations.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

pk804 will respond to all verifiable data rights requests within 30 calendar days. Where the complexity or volume of requests requires additional time, pk804 will notify you of the extended timeline within the initial 30-day period.

The pk804 platform is exclusively intended for adults aged 21 years and older. pk804 does not knowingly collect personal data from individuals under the age of 21 under any circumstance.

CNIC-based age verification is enforced as a mandatory step during account registration. No account activation occurs prior to successful identity and age verification. Any account found to have been created by or on behalf of an individual under 21 years of age will be immediately terminated, all associated data deleted (subject to any overriding AML or fraud investigation requirements), and all funds handled in accordance with the circumstances of the case.

If pk804 becomes aware that personal data has been collected from an individual under 21 years of age, we will take immediate steps to delete that data and terminate the associated account. If you believe a minor has created a pk804 account, please contact pk804 support immediately.

As an internationally licensed gaming operator, pk804 may process and store personal data on servers located in jurisdictions outside Pakistan. In all cases where personal data is transferred internationally, pk804 ensures that:

• The receiving jurisdiction provides an adequate level of data protection, or
• Appropriate safeguards are in place through contractual data protection clauses binding the data recipient to standards equivalent to those applied by pk804, or
• The transfer is necessary for the performance of the contract between you and pk804 (for example, processing your payment through an internationally hosted payment gateway).

All third-party service providers who receive pk804 member data in connection with international transfers are contractually required to maintain data security standards consistent with this Privacy Policy and applicable international data protection law.

pk804 reserves the right to update this Privacy Policy at any time in response to changes in applicable law, our licensing requirements, our business operations, or data processing practices. When material changes are made, pk804 will:

• Update the "Effective Date" displayed at the top of this Policy
• Display a prominent notice on the pk804 platform informing members of the update for a period of not less than 14 days
• Where changes are significant, send a notification to registered members at their primary contact address

Your continued use of the pk804 platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept material changes to this Policy, you should cease using the pk804 platform and contact support to close your account.

For any queries, rights requests, or formal complaints relating to the processing of your personal data by pk804, please contact our Privacy Officer through the following channels:

pk804 Privacy Officer
Support Email: support@pk804.org
Subject Line: Privacy Policy Query / Data Rights Request
Response Time: Within 48 hours for acknowledgement; within 30 days for full resolution
Languages: English and Urdu

pk804 is committed to resolving all privacy-related queries and complaints promptly and transparently. Where a member is not satisfied with pk804's response to a data rights request or privacy complaint, the matter may be escalated to the relevant data protection supervisory authority under pk804's international operating jurisdiction.