Privacy Policy

1 Who We Are

This Privacy Policy is issued by the operator of the 39pkr online gaming platform, accessible at https://39pkr.com (referred to in this document as "39pkr", "we", "us", or "our"). 39pkr operates as a licensed online casino and sportsbook, offering cricket betting, live dealer games, slot games, Andar Bahar, Fishing Disco, and related gaming services primarily to English-speaking users in Pakistan.

For the purposes of applicable data protection legislation, 39pkr is the data controller in respect of the personal data you provide when registering an account, making a deposit, placing a wager, or otherwise interacting with our platform. As data controller, 39pkr determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

2 Data We Collect

39pkr collects personal data across several categories, depending on how you interact with our platform. The following table sets out the main categories of data we may hold about you:

We do not intentionally collect any sensitive special-category data (such as health information, political opinions, or biometric data used for identification purposes) beyond what is strictly required under our KYC and anti-money laundering obligations.

3 How We Collect Your Data

39pkr collects personal data through the following primary channels:

• Direct interactions: Data you provide when completing the account registration form, submitting KYC documents, making deposits and withdrawals, contacting our support team, or updating your account profile.
• Automated technologies: Technical and usage data collected automatically when you access the 39pkr platform, including through cookies, server logs, pixel tags, and similar tracking technologies embedded in the platform interface.
• Third-party verification providers: Identity and address verification data supplied to us by regulated KYC/AML service providers we engage to complete mandatory player due diligence checks prior to processing withdrawals.
• Payment processors: Transaction confirmation and payment method reference data shared with us by approved payment providers (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 network providers) as a necessary part of processing your deposits and withdrawals.
• Game providers: Aggregate session data provided by our third-party game software suppliers relating to game outcomes, RNG certification, and gaming activity, used for auditing and responsible gaming purposes.

4 Legal Basis for Processing

39pkr processes your personal data only where a valid legal basis exists under applicable data protection law. The primary legal bases on which we rely are:

1. Performance of a contract: Processing that is necessary to provide the services you have signed up for — including account maintenance, game access, and payment processing — is carried out on the basis that it is necessary for the performance of our contract with you.
2. Legal obligation: Processing required to comply with our obligations under anti-money laundering (AML) regulations, gaming licensing conditions, and financial crime prevention frameworks constitutes a legal obligation that we cannot opt out of.
3. Legitimate interests: We process certain technical and usage data on the basis of our legitimate interest in operating a secure, fair, and commercially viable platform — including fraud detection, platform security, and aggregate analytics. We have assessed that these interests are not overridden by your rights in the relevant contexts.
4. Consent: Where we send you direct marketing communications (email, SMS promotions, bonus notifications), we do so on the basis of your freely given, specific, informed, and unambiguous consent as recorded at the time of registration or account settings update. You may withdraw this consent at any time.

5 How We Use Your Data

The personal data 39pkr holds about you is used for the following purposes, each of which corresponds to a lawful basis described in Section 4:

• Creating and managing your 39pkr player account, including authentication and session management.
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 channels.
• Conducting mandatory Know Your Customer (KYC) and Anti-Money Laundering (AML) identity verification prior to processing withdrawals.
• Providing access to all gaming products on the platform, including cricket betting, live casino, slots, Andar Bahar, and Fishing Disco games.
• Delivering customer support services, including responding to queries, handling complaints, and managing self-exclusion or responsible gaming requests.
• Sending you promotional communications, bonus offers, and tournament notifications — but only where you have opted in to receive such communications.
• Detecting and preventing fraudulent activity, bonus abuse, multi-accounting, and other forms of prohibited conduct as defined in our Terms & Conditions.
• Fulfilling our responsible gaming obligations, including monitoring for signs of problem gambling behaviour and administering self-exclusion or cool-off requests.
• Maintaining platform security, conducting system audits, and generating anonymised aggregate analytics to improve the 39pkr user experience.
• Complying with regulatory reporting obligations under our gaming license and applicable financial crime prevention legislation.

6 Sharing Your Data

39pkr does not sell or rent your personal data to any third party. We share data only in the following limited and controlled circumstances:

1. KYC & AML service providers: We engage regulated third-party identity verification providers to conduct mandatory due diligence. These providers receive only the data necessary to complete the verification and are bound by strict data-processing agreements.
2. Payment processors: Transaction-related data is shared with the relevant payment provider (e.g., JazzCash, EasyPaisa, HBL, Meezan Bank) as strictly necessary to complete your deposit or withdrawal request.
3. Game software providers: Session and outcome data is exchanged with our licensed game content providers for RNG audit, game integrity, and technical support purposes. These providers operate under confidentiality agreements and are not permitted to use your data for any other purpose.
4. Regulatory and law enforcement authorities: Where required by applicable law, a court order, our gaming license obligations, or a lawful request from a financial intelligence unit or law enforcement authority, 39pkr will disclose personal data as legally required. We will inform you of any such disclosure where permitted by law to do so.
5. Fraud prevention and security services: We may share limited technical and identity data with fraud prevention networks and cybersecurity providers where we have a legitimate interest in protecting the platform and our players from criminal activity.
6. Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of 39pkr's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity in advance where practically possible.

7 Cookies & Tracking Technologies

39pkr uses cookies and similar technologies (local storage, session tokens, and analytics pixels) to operate and improve the platform. The table below summarises the types of cookies we use:

You may manage your cookie preferences at any time through your browser settings. Disabling essential cookies will impair your ability to log in and use the platform. Disabling analytics or marketing cookies will not affect your access to games or your account functionality.

8 Data Retention

39pkr retains your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, including our legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following account closure, in compliance with AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, in accordance with applicable financial crime prevention obligations.
• KYC documents: Retained for the period required under our gaming license jurisdiction's AML regulations, typically 5 years from the date of verification or account closure, whichever is later.
• Customer support communications: Retained for 3 years from the date of the relevant interaction, or longer where the communication relates to an unresolved dispute or ongoing compliance matter.
• Technical and usage data (logs): Retained for up to 24 months in identifiable form, after which data is either deleted or anonymised for aggregate analytics purposes.
• Marketing preferences: Retained until you withdraw your consent or close your account. Opt-out records are retained indefinitely to ensure we do not re-contact you without renewed consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request early deletion of your data by contacting our support team, subject to our ability to comply with applicable legal retention obligations.

9 Data Security

39pkr implements a layered approach to data security, combining technical, organisational, and procedural measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• Industry-standard TLS 1.2/1.3 encryption for all data transmitted between your device and the 39pkr platform.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial account references.
• Role-based access controls ensuring that only staff with a specific operational need can access personal data, with all access logged and auditable.
• Regular penetration testing and vulnerability assessments of platform infrastructure conducted by independent cybersecurity specialists.
• Multi-factor authentication options for player accounts to reduce the risk of unauthorised login.
• A documented data breach response procedure requiring notification to affected players and relevant authorities within the timeframes prescribed by applicable law.

10 Your Data Rights

Subject to applicable law and our legal retention obligations, you hold the following rights in relation to your personal data held by 39pkr:

1. Right of access: You may request a copy of all personal data 39pkr holds about you, along with information about how it is being used. We will respond within 30 days of a verified request.
2. Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Some corrections can be made directly within your account settings panel.
3. Right to erasure ("right to be forgotten"): You may request deletion of your personal data where we no longer have a lawful basis to retain it. This right is subject to our legal obligation to retain certain records for AML and gaming license compliance purposes.
4. Right to restriction: You may request that 39pkr restricts its processing of your data in certain circumstances — for example, while a data accuracy dispute is being resolved.
5. Right to data portability: Where processing is based on your consent or on a contract with you, and is carried out by automated means, you may request a machine-readable copy of the data you have provided to us.
6. Right to object: You have the right to object to processing carried out on the basis of our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
7. Right to withdraw consent: Where processing is based on your consent (e.g. marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal. Opt-out links are included in all marketing emails.

To exercise any of the above rights, contact the 39pkr data team at [email protected] with the subject line "Data Rights Request" and your registered account username. We will verify your identity before processing any request.

11 Children & Minors

The 39pkr platform is strictly intended for users who are 21 years of age or older. We do not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. Registration by minors is expressly prohibited under our Terms & Conditions and our gaming license obligations.

If 39pkr becomes aware that personal data has been collected from a person under the age of 21 — whether through fraudulent age misrepresentation or otherwise — we will immediately suspend the relevant account, delete all associated personal data to the extent permitted by our legal obligations, and report the matter to relevant authorities where required.

Parents and guardians who believe a minor may have accessed or registered on the 39pkr platform are encouraged to contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

12 International Data Transfers

As an internationally licensed gaming operator, 39pkr may transfer your personal data to service providers located outside Pakistan. Such transfers may occur in connection with cloud hosting infrastructure, KYC verification services, game software providers, and payment processing networks.

Where personal data is transferred internationally, 39pkr takes steps to ensure that adequate protections are in place, including:

• Transferring data only to jurisdictions that provide an adequate level of data protection under applicable standards.
• Requiring all third-party recipients of personal data to execute data-processing agreements containing appropriate safeguards and confidentiality obligations.
• Limiting the scope of data transferred to only what is strictly necessary for the specific processing purpose.

By registering an account on the 39pkr platform, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan as described in this section.

13 Third-Party Links

The 39pkr platform may, from time to time, contain references or navigation to content provided by third-party game studios or payment service landing pages. This Privacy Policy applies solely to data processing carried out by 39pkr on the 39pkr platform. 39pkr is not responsible for the privacy practices of any third party whose services you may access in connection with using our platform.

We encourage you to review the privacy policies of any third-party payment provider or game software studio whose services you interact with, as their data handling practices may differ from those of 39pkr.

14 Updates to This Privacy Policy

39pkr reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our platform services. The effective date at the top of this document will be updated whenever a material change is made.

Where changes are material — meaning they significantly affect your rights or how we use your data — we will notify registered players by email to the address associated with their account or via a prominent platform notification prior to the changes taking effect.

Your continued use of the 39pkr platform following the posting of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any update to this policy, you should cease using the platform and request account closure.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or 39pkr's data handling practices, please contact our dedicated data support team using the details below:

• Email: [email protected] — Subject line: "Privacy Query" or "Data Rights Request"
• Support Hours: Monday to Sunday, 09:00 – 01:00 PST
• Response Time: We aim to respond to all privacy-related queries within 5 business days and to formal data rights requests within 30 calendar days of identity verification.

When contacting us regarding a data rights request, please include your registered 39pkr username and the email address associated with your account so that we can verify your identity efficiently. We will not process data requests from unverified individuals to protect against fraudulent access to third-party account data.