Privacy Policy — 33pak Platform

1 Introduction

33pak ("we", "us", "our" or "the Platform") is an English-language online gaming and sports betting information platform accessible at 33pak.cam, serving users primarily in Pakistan and the wider South Asian region. We respect your privacy and are committed to protecting the personal data you share with us when accessing or using the Platform.

This Privacy Policy ("Policy") describes in full detail: what personal data we collect; how and why we collect it; the legal grounds on which we process it; with whom we share it; how long we retain it; the security measures we apply; and the rights you hold in relation to your data.

This Policy applies to all users of the Platform, including registered account holders, unregistered visitors and individuals who interact with 33pak via email or other communication channels. It applies regardless of your location, including users accessing the Platform from cities across Pakistan such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar.

By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy. If you do not agree to the terms of this Policy, please discontinue use of the Platform immediately.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, email address, IP address, device identifiers and account credentials.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion or any combination thereof.
• "Data Controller" means 33pak, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third-party entity that processes Personal Data on behalf of 33pak under a contractual arrangement and subject to documented instructions.
• "User" or "Data Subject" means any identified or identifiable natural person whose Personal Data is processed by 33pak.
• "Consent" means a freely given, specific, informed and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a stated purpose.
• "Cookies" means small text files placed on a user's device by a web server to store session or preference information.
• "KYC" means Know Your Customer identity verification, including document-based checks to confirm identity, age and source of funds.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation.
• "Third Country" means any country outside the jurisdiction in which 33pak's primary data processing operations are based.

3 Personal Data We Collect

We collect the following categories of Personal Data, depending on your interaction with the Platform:

3.1 Registration & Account Data

• Full legal name
• Date of birth (for age verification purposes)
• Residential address, including city and postal code
• Email address
• Username and hashed password
• Mobile phone number (where provided)

3.2 Identity Verification (KYC) Data

• Copies of government-issued identity documents (e.g., CNIC, passport)
• Proof of address documentation
• Source of funds documentation (where required by regulatory obligations)
• Facial recognition or liveness check data (where applicable to the KYC solution in use)

3.3 Financial Data

• Deposit and withdrawal transaction records (amounts, dates, methods)
• Payment method references (e.g., mobile wallet identifiers, bank account references — not full card numbers)
• PKR balances and transaction histories

3.4 Technical & Usage Data

• IP address and approximate geolocation
• Browser type, version and operating system
• Device identifiers (where applicable)
• Pages visited, time spent and click-path data
• Session timestamps and login history

3.5 Communications Data

• Support ticket content and response history
• Email correspondence with the 33pak team
• Feedback, survey responses and voluntary submissions

4 How We Collect Data

33pak collects Personal Data through the following methods:

• Direct submission: Information you actively provide during account registration, KYC verification, deposit/withdrawal requests or when contacting support.
• Automated collection: Technical data collected automatically when you interact with the Platform, including through cookies, server logs and analytics tools.
• Third-party sources: Identity verification data received from KYC service providers; fraud-screening data from risk management partners; payment confirmation data from payment processors. These providers are contractually bound to handle data in accordance with applicable data protection standards.
• Public sources: In limited circumstances and where legally permitted, we may cross-reference publicly available information (e.g., sanctions lists, politically exposed persons databases) as part of anti-money laundering obligations.

5 Legal Basis for Processing

We process your Personal Data only where a valid legal basis exists. The applicable legal bases are:

• Contractual necessity: Processing required to enter into and perform our agreement with you, including account registration, KYC verification and transaction management.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, age verification requirements and financial record-keeping duties.
• Legitimate interests: Processing necessary for 33pak's legitimate business interests, including fraud prevention, platform security, abuse detection and service improvement — provided such interests are not overridden by your privacy rights.
• Consent: Where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

6 How We Use Your Data

33pak uses the Personal Data we collect for the following purposes:

• Account management: Creating, maintaining and securing your user account, including processing login authentication and password resets.
• Identity and age verification: Confirming that you meet the minimum age requirement (18+ or higher where required) and satisfy applicable KYC requirements.
• Transaction processing: Facilitating deposits and withdrawals via payment methods familiar to Pakistani users, including mobile wallet references such as Easypaisa, JazzCash and Raast, and bank references such as HBL, UBL, Meezan Bank and Bank Alfalah. These references are contextual only and do not imply endorsement.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, account takeovers, bonus abuse and other unauthorised conduct.
• Regulatory compliance: Meeting AML, KYC and counter-financing of terrorism (CFT) obligations applicable under the operator's license jurisdiction.
• Responsible gambling: Monitoring usage patterns to identify signs of problem gambling behaviour and applying or recommending appropriate protective measures.
• Customer support: Responding to enquiries, resolving disputes and maintaining support records.
• Platform improvement: Analysing usage data to improve the design, functionality and content of the Platform.
• Marketing communications: Sending promotional content where you have provided explicit consent. You may opt out at any time.

7 Data Sharing & Disclosure

33pak does not sell, rent or trade your Personal Data. We may share data with the following categories of recipient, strictly on a need-to-know basis:

7.1 Service Providers & Data Processors

Third-party companies engaged to provide services on our behalf, including KYC verification providers, payment processors, cloud hosting providers, analytics platforms and customer support software vendors. These parties are contractually required to process data only as instructed and to maintain appropriate security standards.

7.2 Regulatory & Law Enforcement Bodies

Where required by applicable law, court order or binding regulatory request, 33pak may disclose Personal Data to competent authorities. We will, where legally permissible, notify you of such a request before complying.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets, Personal Data held by 33pak may be transferred to the successor entity, subject to equivalent privacy protections being maintained. Users will be notified of any such transfer where feasible.

7.4 With Your Consent

We may share your data with additional third parties where you have given explicit consent for a specific purpose, which you may withdraw at any time.

8 Cookies & Tracking Technologies

33pak uses cookies and similar technologies (including web beacons, pixel tags and local storage) to operate, improve and analyse the Platform. The following categories of cookies are in use:

You can manage cookie preferences at any time via your browser settings. Please note that disabling strictly necessary or functional cookies may affect your ability to use certain features of the Platform. Withdrawing consent for analytical or marketing cookies will not affect your core account functionality.

9 Data Retention

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following retention guidelines apply:

• Account data: Retained for the duration of the account relationship, plus a minimum of five (5) years following account closure to satisfy AML and regulatory record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with AML and financial crime prevention requirements.
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction, or longer where records are relevant to ongoing disputes or regulatory matters.
• Technical and analytical data: Typically retained in aggregated or anonymised form for up to twenty-four (24) months.
• Marketing consent records: Retained for the duration of consent plus one (1) year to evidence compliance.

Where Personal Data is no longer required, it will be securely deleted, anonymised or rendered irrecoverable in accordance with our internal data destruction procedures.

10 Data Security

33pak implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest using AES-256 or equivalent standards.
• Multi-factor authentication (MFA) options for user accounts and mandatory MFA for all administrative access.
• Role-based access controls ensuring that only authorised personnel can access Personal Data, and only to the extent necessary for their function.
• Regular independent security audits and penetration testing.
• Continuous monitoring for anomalous access patterns and intrusion attempts.
• Documented incident response procedures for data breach detection, containment and notification.

Despite these measures, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and notifying 33pak immediately of any suspected unauthorised access.

11 International Data Transfers

33pak operates globally and may transfer Personal Data to, or process it in, countries outside Pakistan or your country of residence. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that required under applicable data protection law, including:

• Transferring data only to jurisdictions recognised as providing adequate data protection standards.
• Applying contractual safeguards (e.g., Standard Contractual Clauses or equivalent contractual protections) where data is transferred to processors in third countries.
• Conducting transfer impact assessments where required to ensure that the rights of Data Subjects are not undermined by the transfer.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Pakistan. If you have questions about specific transfer mechanisms applicable to your data, please contact us at the details provided in Section 16.

12 Your Rights

Subject to applicable data protection law, you hold the following rights in relation to your Personal Data processed by 33pak. To exercise any of these rights, submit a written request to our support team as described in Section 16. We will respond within thirty (30) calendar days, which may be extended by up to a further sixty (60) days for complex or high-volume requests.

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for its original purpose, where consent has been withdrawn, or where processing is unlawful — subject to our legal retention obligations.
• Right to Restriction: You may request that processing of your data be restricted in certain circumstances, such as where accuracy is contested or processing is subject to an objection.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request your Personal Data in a structured, commonly used and machine-readable format.
• Right to Object: You may object at any time to processing based on legitimate interests, including profiling for direct marketing purposes.
• Rights Related to Automated Decision-Making: Where decisions that significantly affect you are made solely by automated means (including profiling), you have the right to request human review, to express your point of view, and to contest the outcome.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

13 Children & Minors

The 33pak Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the applicable operator's license jurisdiction. We do not knowingly collect, process or retain Personal Data from individuals under the age of 18.

If we become aware or have reasonable grounds to suspect that Personal Data has been provided by or collected from a minor, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has accessed the Platform or provided their data, please notify us immediately at the contact details in Section 16.

We strongly recommend that parents and guardians in Pakistan and worldwide install parental control software on devices accessible to minors to prevent inadvertent access to online gaming platforms. Responsibility for ensuring that minors cannot access this Platform ultimately rests with the adults in the household.

14 Third-Party Links & Services

The Platform may contain references to or descriptions of third-party operators and services. Where such references include informational hyperlinks or descriptions, please be aware that 33pak does not control those third-party platforms and is not responsible for their privacy practices.

Each third-party operator maintains its own privacy policy and data processing practices. 33pak makes no representations regarding the adequacy or appropriateness of those policies. Before providing any Personal Data to a third-party operator, we strongly encourage you to review that operator's privacy policy independently.

References to payment providers — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are made solely as familiar Pakistani payment context. These references do not constitute endorsement of or affiliation with those providers, and the data practices of those institutions are entirely independent of 33pak.

15 Changes to This Privacy Policy

33pak reserves the right to update or modify this Privacy Policy at any time. Changes will be published on this page with a revised "Last Updated" date. Where changes are material — such as new categories of data being collected, new purposes for processing, or changes to your rights — we will provide prominent notice on the Platform for a minimum of fourteen (14) days before the changes take effect.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement and acceptance of the updated terms. We encourage you to review this page periodically. If you do not agree with any material changes, please discontinue use of the Platform and contact us to request account closure.

16 Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 12, please contact the 33pak Data Protection team using the details below. We aim to acknowledge all privacy-related enquiries within five (5) business days and provide a substantive response within thirty (30) calendar days.