92pakk Privacy Policy

92pakk is an internationally licensed online casino and sports betting platform operating at 92pakk.app. The platform is operated by 92pakk Gaming, a company incorporated under the laws of its licensing jurisdiction and holding a valid international gaming licence that permits the provision of online casino, sports betting, and lottery services.

For the purposes of data protection law, 92pakk Gaming acts as the data controller in respect of the personal data of all registered users. This means that 92pakk determines the purposes and means by which your personal data is processed.

This Privacy Policy applies to all personal data collected through the 92pakk website at 92pakk.app, the 92pakk mobile application, and any correspondence between you and 92pakk through any channel, including email and live chat.

92pakk collects the following categories of personal data from registered users and, in some cases, from visitors to the 92pakk website:

92pakk does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data (other than in connection with responsible gaming requests), or biometric data.

92pakk collects personal data through the following methods:

• Directly from you: Information you provide during account registration, KYC document upload, payment method verification, support communications, and when you update your account preferences.
• Automatically during platform use: Technical data including IP addresses, device identifiers, and behavioural analytics data collected via cookies and server-side logging when you visit the 92pakk website or use the mobile app.
• From third-party payment processors: Transaction confirmation data from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank when you initiate deposits or withdrawals. This data is limited to what is necessary to confirm and reconcile the transaction.
• From identity verification providers: Where 92pakk uses a third-party KYC verification service to validate CNIC authenticity, that provider may supply a verification result (pass/fail) and associated confidence score to 92pakk.
• From fraud prevention services: 92pakk may receive flagged-account alerts or risk scores from third-party fraud prevention services where such data is necessary to protect the security and integrity of the platform.

92pakk processes your personal data for the following specific purposes:

• Account creation and management: To register your account, maintain your profile, process your login, and manage your account settings.
• Identity and age verification (KYC): To verify that you are who you say you are, that you are aged 21 or above, and that you are not subject to any self-exclusion orders — as required under our international gaming licence.
• Processing deposits and withdrawals: To initiate, confirm, and reconcile PKR financial transactions via your chosen payment method (JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank).
• Providing gaming services: To deliver casino games, sports betting markets, live dealer games, and lottery draws, and to record the outcomes of your gaming activity accurately.
• Responsible gaming compliance: To monitor your gaming activity for indicators of problem gambling behaviour, to apply the self-imposed limits and exclusions you have set, and to contact you proactively where our monitoring detects potential harm.
• Anti-money laundering (AML) and fraud prevention: To comply with our AML obligations under our gaming licence, to detect and prevent fraudulent account activity, and to report suspicious transactions to the relevant financial intelligence authorities where required.
• Customer support: To respond to your queries, process your complaints, and manage your support interactions.
• Marketing communications: To send you promotional offers, bonus notifications, and platform news — but only where you have explicitly opted in. You can withdraw consent at any time.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the design, performance, and game offering of the 92pakk platform.

For each processing activity, 92pakk relies on one of the following legal bases:

• Contract performance: Processing that is necessary to fulfil the contractual obligations set out in the 92pakk Terms & Conditions — including account management, game delivery, and payment processing.
• Legal obligation: Processing required to comply with our obligations under our international gaming licence — including KYC verification, AML reporting, and responsible gaming monitoring.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregated analytics, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications, non-essential cookies, and any other processing where we have explicitly asked for and received your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

92pakk does not sell your personal data. We share personal data with third parties only where strictly necessary and only with the categories of recipient listed below:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum data necessary to initiate and confirm your requested financial transactions.
• KYC and identity verification providers: CNIC data and document images are shared with our contracted KYC service provider for the purpose of identity and age verification. This provider is contractually prohibited from using your data for any other purpose.
• Game software providers: Game outcome and session data may be shared with third-party game software providers (such as slot and live dealer game studios) to the extent necessary for them to deliver their games and resolve disputes.
• Fraud and AML monitoring services: Transaction and behavioural data may be shared with contracted fraud prevention and AML monitoring services for the purpose of platform security and regulatory compliance.
• Regulatory and law enforcement authorities: Where required by law, by a court order, or by a regulatory authority with jurisdiction over 92pakk's gaming licence, we will disclose personal data to the relevant authority.
• IT infrastructure providers: Hosting, cloud storage, and IT security providers who process data on our behalf under strict data processing agreements.

All third parties with whom 92pakk shares personal data are contractually required to handle that data in accordance with applicable data protection standards and to use it solely for the specific purpose for which it was shared.

92pakk uses cookies and similar tracking technologies on its website and mobile application. Cookies are small text files stored on your device that help the platform function correctly and allow us to understand how users interact with the site.

92pakk uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies and security tokens. These cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your language preference, game lobby layout, and other personalisation settings to improve your experience on return visits.
• Analytics cookies: Collect anonymised data about how users navigate the platform — including pages visited, session duration, and error encounters — to help us improve the site. Analytics data is not linked to your personal identity.
• Marketing cookies: Used only where you have explicitly opted in. These may track your interaction with 92pakk promotional content so that we can present relevant offers. Marketing cookies can be disabled at any time via your browser settings or the 92pakk cookie preferences panel.

You can manage your cookie preferences through your browser settings. Note that disabling functional or analytics cookies may affect the quality of your platform experience but will not prevent you from accessing core gaming services.

92pakk retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by law and regulatory obligation. The following retention periods apply:

• Account data and KYC documents: Retained for a minimum of five (5) years following account closure, as required by the AML obligations under our gaming licence.
• Financial transaction records: Retained for five (5) years from the date of each transaction, consistent with standard financial record-keeping requirements.
• Gaming activity logs: Retained for three (3) years from the date of each session, to facilitate dispute resolution and responsible gaming monitoring.
• Customer support communications: Retained for two (2) years from the date of the most recent interaction in each support thread.
• Marketing preference records: Retained for as long as your account remains active plus one (1) year, to maintain an auditable record of consent.
• Technical and analytics data: Anonymised after twelve (12) months and retained in anonymised form for up to three (3) years for platform improvement analysis.

Once the applicable retention period expires, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately technically feasible (for example, in backup archives), the data is isolated and protected from further active processing until it can be deleted.

As a data subject, you hold the following rights in respect of your personal data held by 92pakk. To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Request". We will respond within thirty (30) days.

92pakk enforces a strict minimum age requirement of 21 years for all registered users. The 92pakk platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21.

Where 92pakk discovers that personal data has been collected from a person under the age of 21 — whether through the registration process, KYC verification, or any other means — that account will be immediately suspended, all associated data will be securely deleted (subject to any statutory obligations to retain evidence of the breach), and, where required, the matter will be referred to the relevant regulatory authority.

Parents and guardians in Pakistan are strongly encouraged to make use of internet parental control software to prevent minors from accessing online gambling platforms. If you believe that a minor has registered an account at 92pakk, please contact [email protected] immediately.

As an internationally licensed gaming platform serving Pakistani users, 92pakk may transfer personal data across international borders — for example, to cloud hosting providers, KYC verification services, or game software studios operating in other countries.

Where personal data is transferred internationally, 92pakk takes the following measures to ensure an adequate level of protection is maintained:

• Transfers are made only to countries or organisations that provide an adequate level of data protection as assessed by 92pakk's legal and compliance team.
• Where transfers are made to countries not deemed to provide adequate protection by default, 92pakk puts in place appropriate contractual safeguards (including standard contractual clauses or equivalent mechanisms) with the receiving party.
• All third-party service providers receiving transferred data are contractually required to maintain security and confidentiality standards consistent with this Privacy Policy.

92pakk implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration:

• Encryption: TLS 1.3 for all data in transit; AES-256 encryption for all data at rest, including database records and stored documents.
• Access controls: Role-based access control (RBAC) ensures that 92pakk employees can only access personal data that is strictly necessary for their job function. All access is logged and audited.
• Two-factor authentication: All 92pakk staff with access to personal data systems are required to use two-factor authentication. Users are strongly encouraged to enable 2FA on their own accounts.
• Penetration testing: The 92pakk platform undergoes regular penetration testing and security audits conducted by independent third-party security firms.
• Incident response: 92pakk maintains a documented data breach incident response plan. In the event of a breach, our response team is activated within one hour and impacted users are notified within seventy-two (72) hours.
• Data minimisation at source: Our platform is configured to capture only the minimum data technically necessary at every interaction point, reducing the exposure surface in the event of a security incident.

While 92pakk implements the highest standard of security reasonably achievable, no internet-based service can guarantee absolute security. Users are responsible for maintaining the confidentiality of their own login credentials and for notifying 92pakk immediately if they suspect unauthorised account access.

92pakk reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes in the services we offer. Where material changes are made — particularly changes that expand the purposes for which your data is used or the categories of third parties with whom it is shared — 92pakk will notify you via email to your registered address at least fourteen (14) days before the changes take effect.

The date of the most recent update is displayed at the top of this policy. It is your responsibility to review this Privacy Policy periodically to remain aware of any changes. Continued use of the 92pakk platform following the effective date of any update constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a complaint about how your personal data has been handled, please contact the 92pakk Data Protection team:

All data subject requests are acknowledged within forty-eight (48) hours and substantively responded to within thirty (30) days. If we require additional time to fulfil a complex request, we will notify you of the delay and provide an updated timeline.

If you are not satisfied with our handling of your data or our response to a data subject request, you have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction where you reside or where the alleged infringement occurred.