pk356 Privacy Policy — Your Data, Our Responsibility

This Privacy Policy ("Policy") is issued by pk356 ("we", "us", "the Controller"), the operator of the online gaming platform accessible at pk356.bio. This Policy describes our practices concerning the personal data of all registered users ("you", "the Player", "the Data Subject") and applies to all data processing activities undertaken by pk356 in connection with your use of the Platform. This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy. By creating a pk356 account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

pk356 is the data controller for all personal information collected through the Platform. As the data controller, pk356 determines the purposes for which and the means by which personal data is processed. pk356 operates under an international gaming authority license and is subject to the data protection obligations attached to that license, including requirements related to KYC data handling, AML record-keeping, and player data security.

For all data protection enquiries, requests to exercise your rights, or complaints related to how pk356 handles your personal data, please contact our Data Protection team using the details provided in Section 13 of this Policy.

pk356 collects personal data across several categories, each collected for specific defined purposes. The following table summarises the categories of data we hold:

2.1 Data We Do Not Collect

pk356 does not collect, store, or process the following categories of sensitive personal data unless directly relevant to a specific legal obligation: racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data (other than as contained in KYC identity documents), or health data (unless disclosed voluntarily in the context of a responsible gaming self-exclusion request).

pk356 processes your personal data for the following defined purposes:

• Account Management: Creating, maintaining, authenticating, and securing your pk356 account. This includes password management, session authentication, and device verification.
• Transaction Processing: Executing deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20. Payment data is shared with the relevant payment processor solely to complete your transaction.
• Identity Verification (KYC): Verifying your identity and age (21+) as required by our international gaming license. KYC verification is mandatory before processing withdrawal requests. This process may involve sharing documentation with third-party KYC verification service providers operating under confidentiality obligations.
• Anti-Money Laundering (AML) Compliance: Monitoring transaction patterns and account activity to detect and report suspicious activity as required under our gaming license AML obligations. This is a legal requirement, not a discretionary process.
• Responsible Gaming: Using gaming activity data to monitor for patterns indicative of problem gambling, enforcing deposit limits and self-exclusion settings you have selected, and contacting you if our responsible gaming systems detect concerning patterns.
• Customer Support: Responding to your queries, resolving account disputes, investigating complaints, and maintaining records of support interactions for quality and compliance purposes.
• Security & Fraud Prevention: Analysing login activity, device fingerprints, and transaction patterns to detect and prevent fraud, account takeover, bonus abuse, collusion, and other prohibited activities.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players navigate pk356, which game categories are most popular, and where the user experience can be improved. This analysis does not involve individualised profiling for marketing purposes.
• Legal & Regulatory Compliance: Fulfilling all obligations under our gaming license, including record-keeping, audit access, and regulatory reporting to the competent gaming authority.

pk356 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — running your account, processing payments, providing access to games, and delivering customer support. Without this processing, pk356 cannot provide its services to you.
• Legal Obligation: Processing required to comply with our international gaming license conditions, AML regulations, KYC requirements, and any applicable legal orders. This processing cannot be refused or opted out of while you hold an active pk356 account.
• Legitimate Interests: Processing undertaken for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics — where these interests are not overridden by your fundamental data protection rights.
• Consent: Where pk356 processes your data on the basis of consent (for example, sending you promotional communications about new games or bonuses), you have the right to withdraw that consent at any time by contacting pk356 support or adjusting your account notification settings.

pk356 shares your personal data with third parties only as follows:

5.1 Payment Processors

When you make a deposit or withdrawal, pk356 shares the minimum necessary payment data with the relevant payment network — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, or blockchain validators for USDT TRC20 transactions. These processors receive only the data necessary to execute your transaction. They cannot use your data for any independent purpose.

5.2 Game Providers

To provide certified gaming experiences, pk356 integrates with licensed international game studios including Pragmatic Play, NetEnt, Play'n GO, and others. These providers may receive anonymised session identifiers and bet data necessary to serve and audit game results. They do not receive your name, CNIC, or payment details.

5.3 KYC Verification Partners

Your KYC documents — CNIC, proof of address, source of funds declarations — may be processed by a third-party identity verification service engaged by pk356. These partners operate under strict data processing agreements and are prohibited from using your documentation for any purpose other than completing your pk356 verification.

5.4 Regulatory Authorities

As required by our international gaming license, pk356 may share player data — including account activity, transaction records, and identity documentation — with the gaming regulatory authority under which we operate, or with law enforcement bodies when compelled by a lawful order or court direction.

pk356 uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies used on pk356 are:

• Strictly Necessary Cookies: Required for the Platform to function — session authentication, load balancing, security token management. These cannot be disabled without breaking the Platform's core functionality.
• Functional Cookies: Remember your preferences — language settings, game lobby layout, recently played games — to personalise your pk356 experience across sessions.
• Analytics Cookies: Collect anonymised and aggregated data about how players navigate pk356 — which pages load slowly, where users encounter friction, which game categories see the most engagement. This data is used exclusively for Platform improvement. No individual user is identified in this analysis.
• Security Cookies: Support fraud detection and anomaly detection systems, including device fingerprinting used to identify potentially compromised account access attempts.

You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will affect Platform functionality. For all other cookie categories, browser-level controls are available in all modern browsers used in Pakistan including Chrome, Firefox, and Safari.

pk356 implements a layered technical and organisational security architecture to protect your personal data:

• Encryption in Transit: All data transmitted between your device and pk356 servers is encrypted via TLS 1.3. The padlock in your browser address bar confirms this encryption is active throughout your session.
• Encryption at Rest: All personal data stored in pk356 databases is encrypted using 256-bit AES encryption. Database administrators cannot read your personal data in plaintext — it is decrypted only by authorised application processes.
• Password Hashing: Your pk356 account password is never stored in a readable form. It is hashed using bcrypt with a unique per-account salt value before storage. Even pk356 system administrators cannot retrieve your password.
• Access Controls: Personal data is accessible only to pk356 staff whose role requires it — support agents can see account identifiers and contact details; payment teams can access transaction records; compliance staff can access KYC documentation. Segregated access prevents any single employee from having unrestricted data access.
• Intrusion Detection: pk356's infrastructure is monitored by automated intrusion detection systems that flag unusual data access patterns, login anomalies, and potential exfiltration attempts for immediate investigation.
• Third-Party Audits: pk356's technical security infrastructure is subject to periodic review as part of our ongoing gaming license compliance obligations.

pk356 retains personal data for the following periods:

• Active Account Data: Retained for the full duration of your pk356 account plus the applicable post-closure retention period.
• Account Closure — General: Following voluntary account closure, personal data is retained for five (5) years to satisfy anti-money laundering record-keeping obligations attached to our gaming license.
• KYC Documents: Retained for five (5) years following account closure or the last transaction, whichever is later, in accordance with AML regulatory requirements.
• Transaction Records: Financial transaction records are retained for seven (7) years as required by standard financial record-keeping obligations applicable to our gaming license jurisdiction.
• Support Communications: Live chat transcripts and email correspondence are retained for three (3) years to support dispute resolution and quality assurance processes.
• Technical Logs: Server logs, session data, and device identifiers are retained for twelve (12) months for security, fraud investigation, and platform stability purposes.

Upon expiry of the applicable retention period, personal data is either securely deleted from all pk356 systems or irreversibly anonymised such that it can no longer be associated with you as an individual.

pk356 respects and upholds your rights over your personal data. The following rights are available to all pk356 players:

pk356 is strictly an adult-only platform. Access to pk356 requires that you are at least twenty-one (21) years of age. pk356 does not knowingly collect personal data from persons under the age of 21. Our KYC identity verification process — which requires submission of a valid Pakistani CNIC or equivalent government-issued photo identification — is specifically designed to prevent access by minors.

If pk356 becomes aware that a person under 21 years of age has accessed the Platform or provided personal data, we will immediately:

• Suspend the associated account;
• Delete all personal data associated with the account to the extent permitted by legal obligations;
• Void all account activity including any winnings; and
• Return deposits subject to investigation findings.

pk356 is operated from an international gaming jurisdiction, and your personal data may be processed on servers located outside Pakistan. This includes servers operated by our cloud infrastructure providers and those operated by our game provider partners in their respective jurisdictions.

Where personal data is transferred internationally, pk356 ensures that appropriate safeguards are in place to protect your data, including:

• Data processing agreements with all international recipients containing data protection obligations equivalent to those imposed on pk356;
• Technical security measures (encryption in transit and at rest) applied consistently regardless of server location;
• Strict limitations on the purposes for which international recipients may use transferred data.

By using pk356 and accepting this Privacy Policy, you consent to the transfer of your personal data to other countries as described in this section, subject to the safeguards described above.

pk356 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, gaming license requirements, regulatory guidance, or applicable laws. When material changes are made to this Policy:

• The "Effective Date" at the top of this document will be updated to reflect the date the revised Policy takes effect;
• Registered players will be notified of material changes via the email address registered to their pk356 account at least 14 days before the changes take effect;
• The updated Policy will be published on the pk356 Privacy Policy page with clear indication of what has changed.

Your continued use of the pk356 Platform following notification of a Privacy Policy update constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you have the right to close your pk356 account before the effective date of the changes.

For all privacy-related enquiries, requests to exercise your data rights, complaints about how pk356 handles your personal data, or questions about this Privacy Policy, please use the following contact channels:

• Live Chat: Available 24/7 on the pk356 Platform. For privacy-specific queries, begin your message with "Privacy / Data Request" for priority routing to our data protection team. Live chat is available in Urdu and English.
• Data Protection Email: [email protected] — reference "Privacy Policy Request" in your message subject. Please note this email address is displayed as plain text and is not a clickable link. Response time is up to 5 business days for data rights requests.

All data rights requests will be acknowledged within 5 business days. We may require you to verify your identity before processing requests to ensure your data is not accessed by an unauthorised third party. This verification step is for your protection.