pk386 Privacy Policy

01 Who We Are

pk386 ("the Company", "we", "us", "our") operates the online gaming platform accessible at pk386.org. For the purposes of this Privacy Policy, pk386 is the data controller responsible for the personal data collected through the Platform.

This Privacy Policy applies to all users ("you", "Player", "User") who access or register on the pk386 Platform, including visitors who browse without registering. By using the pk386 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

Questions about this Privacy Policy or your personal data may be directed to our support team at any time via the contact details set out in Section 14 below.

02 Data We Collect

2.1 Registration Data

When you create a pk386 account, we collect:

• Full name as it appears on your official identification document.
• Date of birth (required to verify the 21+ age restriction).
• Pakistani mobile number (used as your primary account identifier and for OTP verification).
• Email address (used for account notifications and formal correspondence).
• City and province of residence (used for localisation and responsible gaming purposes).
• A password of your choosing, stored in hashed and salted form — never in plain text.

2.2 Identity Verification (KYC) Data

When you request a withdrawal above the applicable KYC threshold, or when pk386 determines that verification is required, we may collect:

• A copy of your CNIC (Computerised National Identity Card) — front and back.
• A recent proof of address document (utility bill, bank statement, or similar).
• Proof of payment method ownership (e.g., a screenshot of your JazzCash or EasyPaisa account in your name).
• A selfie photograph for identity confirmation where required.

2.3 Financial Data

pk386 records transaction histories, deposit amounts, withdrawal requests, account balances, and the payment methods used (e.g., JazzCash account number, EasyPaisa number, bank account details, USDT wallet address). We do not store full payment credentials on our servers — payment processing is handled by our PCI-compliant payment partners.

2.4 Activity Data

In the course of your use of the pk386 Platform, we automatically collect:

• Game play history, wager amounts, outcomes, and session durations.
• Bonus claims, wagering progress, and promotion participation records.
• Login timestamps, session lengths, and logout events.
• Device type, operating system, browser version, and screen resolution.
• IP address and approximate geographic location at the time of each session.

2.5 Communications Data

When you contact pk386 support via live chat or email, we retain transcripts and email correspondence for a period of up to five years. This data is used to maintain service quality, resolve disputes, and train support staff.

2.6 Cookies and Tracking Data

pk386 uses cookies and similar tracking technologies as described in Section 7 of this policy. You may manage cookie preferences through your browser settings.

03 How We Use Your Data

pk386 uses the personal data collected for the following purposes:

pk386 does not use your personal data for automated decision-making that produces significant legal effects without human review. Where automated systems flag an account for review (e.g., for suspected fraud or bonus abuse), a qualified member of the pk386 team makes the final determination.

04 Legal Basis for Processing

pk386 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to provide you with the pk386 Platform services, including account management, game access, and payment processing, as set out in our Terms & Conditions.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) requirements, identity verification obligations, and gaming standards applicable to pk386's operations.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your data protection rights.
• Consent: Processing for optional promotional communications (email newsletters, SMS offers). You may withdraw this consent at any time by contacting pk386 support or using the unsubscribe link in any marketing email.

05 Data Sharing & Disclosure

5.1 Who We Share Data With

pk386 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with the following categories of recipients only where necessary:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction data strictly necessary to process your deposits and withdrawals. Each of these partners operates under its own regulated data protection obligations.
• KYC and identity verification providers: Third-party verification services may process your CNIC and identity documents on our behalf solely for the purpose of fulfilling our KYC obligations.
• Game software providers: Third-party game developers whose titles are available on the pk386 Platform may receive anonymised session and outcome data for quality assurance and RNG audit purposes. No personally identifiable information is shared with game providers.
• IT and infrastructure providers: Cloud hosting, database, and security service providers who operate as data processors on our behalf, bound by strict data processing agreements.
• Legal and regulatory authorities: pk386 will disclose personal data to competent authorities where required to do so by law, court order, or to protect the rights and safety of the Platform and its users.

5.2 International Transfers

Some of pk386's service providers operate outside Pakistan. Where personal data is transferred internationally, pk386 ensures that appropriate safeguards are in place — including contractual data protection clauses with each recipient — to maintain a standard of protection equivalent to that described in this policy.

06 Payment Data & PCI Compliance

pk386 takes the security of financial data with the utmost seriousness. All payment transactions on the pk386 Platform are processed through PCI-DSS compliant payment partners. This means that full card numbers, full bank account credentials, and complete mobile wallet PINs are never transmitted to or stored on pk386 servers.

What pk386 retains for its own records is limited to: the payment method type (e.g., JazzCash, EasyPaisa), the last four digits or partial identifier of the account used, transaction reference numbers, timestamps, and transaction amounts. This data is retained for five years to comply with financial record-keeping requirements.

07 Cookies & Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device on subsequent visits, remember your preferences, and collect analytical information about how the site is used.

7.2 Cookies Used by pk386

7.3 Managing Cookies

You can control or delete cookies through your browser settings at any time. Please note that disabling essential cookies will prevent you from logging into your pk386 account, as they are required for secure session management. Disabling functional or analytical cookies will not affect your ability to play but may reduce the personalisation of your experience.

08 Data Retention

pk386 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status plus five years following closure.
• KYC and identity documents: Retained for a minimum of five years from account closure, or longer where required by AML obligations.
• Financial transaction records: Retained for five years in accordance with financial record-keeping standards.
• Support communications: Retained for up to five years from the date of the interaction.
• Activity and game logs: Retained for three years, then anonymised or deleted.
• Marketing consent records: Retained for the duration of your consent plus two years to demonstrate compliance.

When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be associated with any individual Player.

09 Data Security

pk386 implements layered technical and organisational security measures designed to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and pk386 servers.
• AES-256 encryption for sensitive data fields stored in our databases, including identity documents and payment identifiers.
• Bcrypt password hashing — your pk386 password is never stored in plain text under any circumstances.
• Two-factor authentication (2FA) available for all Player accounts via OTP to your registered mobile number.
• Regular independent security audits and penetration testing of the pk386 Platform infrastructure.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Real-time fraud monitoring systems that flag unusual account activity patterns for immediate human review.

10 Your Data Rights

As a pk386 Player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team as set out in Section 14. pk386 will respond to all valid data rights requests within 30 days.