67pak Privacy Policy — Transparent by Design

67pak is an online casino and sports betting platform operating at 67pak.net, providing casino games, live dealer tables, sports betting, esports wagering, and related entertainment services to registered users. 67pak acts as the data controller in respect of personal data collected from users of the Platform.

As data controller, 67pak determines the purposes for which personal data is collected and the means by which it is processed. Where 67pak engages third-party service providers to process personal data on its behalf, those providers act as data processors operating under binding contractual obligations consistent with this Policy and applicable data protection law.

For all privacy-related enquiries, including requests to exercise your data rights, you may contact our Privacy team using the details provided in Section 15 of this Policy.

When you create a 67pak account, we collect the following personal data: full legal name (as it appears on your CNIC); date of birth; Pakistani mobile number; email address; and residential address including city and province. This data is collected to create and maintain your account, verify your identity, and process communications related to your account.

As part of the Know Your Customer (KYC) process required before processing withdrawals above threshold amounts or in connection with regulatory compliance requirements, 67pak may collect copies of: your Pakistani Computerised National Identity Card (CNIC) — front and back; a selfie or video verification for biometric identity matching; documentation confirming your registered payment method (e.g., a screenshot of your JazzCash or EasyPaisa account in your name); and proof of residential address (such as a recent utility bill or bank statement).

67pak collects transactional financial data including deposit amounts, deposit methods, withdrawal amounts, withdrawal methods, and transaction timestamps. 67pak does not store complete payment credentials such as full bank account numbers or JazzCash/EasyPaisa PINs. Payment credential storage is handled by our payment processor partners in accordance with applicable financial security standards.

67pak records your gameplay and betting history including: games played, stakes wagered, outcomes, session durations, and bonus usage. This data is collected for account management, dispute resolution, responsible gaming monitoring, fraud prevention, and regulatory compliance purposes.

When you access 67pak, we automatically collect technical data including: IP address; device type and operating system; browser type and version; screen resolution; session start and end timestamps; pages and features accessed; and connection type. This data is used for security monitoring, fraud prevention, technical troubleshooting, and Platform optimisation.

Records of your communications with 67pak support — including live chat transcripts, email correspondence, and any submitted support tickets — are retained for a period of up to 3 years to support quality assurance, dispute resolution, and regulatory compliance.

67pak collects personal data through the following channels:

• Directly from you: Via the registration form, account settings pages, KYC document upload portal, payment forms, and any communications you send to 67pak support.
• Automatically during Platform use: Via server logs, session tracking, and first-party cookies and similar technologies described in Section 10 of this Policy.
• From third-party payment processors: Transaction confirmation data shared by JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK when you make deposits or receive withdrawals.
• From identity verification partners: Verification status and fraud risk signals returned by KYC service providers following document submission.
• From game content providers: Game outcome data and RNG audit logs generated by third-party game studios integrated into the 67pak platform, used for dispute resolution and fairness auditing.

67pak processes personal data on the following legal bases:

• Contractual necessity: Processing required to provide the services you have contracted for — including account management, payment processing, game delivery, and support. Without this processing, 67pak cannot provide the Platform to you.
• Legal obligation: Processing required to comply with applicable law — including Anti-Money Laundering (AML) obligations, identity verification requirements, financial record-keeping obligations, and any disclosure requirements imposed by competent regulatory or judicial authorities.
• Legitimate interests: Processing carried out in pursuit of 67pak's legitimate business interests — including fraud prevention, Platform security, responsible gaming monitoring, and system performance optimisation — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for purposes that are not strictly necessary for service delivery but for which you have given your explicit consent — including non-essential marketing communications. Consent may be withdrawn at any time in accordance with Section 11 of this Policy.

Personal data is used to create, maintain, and administer your 67pak account — including authenticating your identity at login, managing your balance and transaction history, applying bonus credits, enforcing account restrictions, and communicating important account notices.

Financial data and identity data are used to process your deposits and withdrawal requests, match payments to the correct account, conduct fraud screening on transactions, and satisfy the transaction reporting obligations imposed on 67pak by applicable financial regulations.

KYC data is used to verify that you are who you say you are, that you meet the minimum age requirement of 21 years, and that your use of 67pak is consistent with applicable AML and know-your-customer regulations. This processing is a legal obligation for 67pak and cannot be waived.

Technical data, gaming activity data, and financial data are used in combination to identify patterns consistent with fraudulent activity, collusion, use of automated betting software, or money laundering. Where suspicious activity is identified, 67pak may suspend the affected account, withhold transactions pending investigation, and report the activity to relevant financial intelligence authorities as required by law.

Gaming activity data and session data are processed by 67pak's responsible gaming monitoring systems to identify patterns that may be consistent with problem gambling behaviour. This processing is conducted in the interests of player welfare. Where concerning patterns are identified, 67pak may contact the account holder and/or apply account restrictions as described in the Responsible Gaming section of the Terms & Conditions.

Communications data, account data, and transaction data are used by the 67pak support team to investigate and resolve your support enquiries, process account change requests, and provide assistance with technical issues.

Where you have given explicit consent, 67pak may use your email address and mobile number to send you information about promotions, bonuses, and new features on the Platform. Marketing communications are sent only to users who have opted in and may be opted out of at any time. 67pak does not send unsolicited SMS marketing without prior consent.

Aggregated and anonymised usage data is analysed by 67pak's product and technology teams to understand how the Platform is being used, identify performance bottlenecks, test new features, and make improvements to the user experience. This analysis is conducted on anonymised data sets that cannot reasonably be used to identify individual users.

67pak does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared with third parties only in the following circumstances:

Transaction data is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK as necessary to process your deposits and withdrawals. These providers act as independent data controllers in respect of data shared with them under their own payment network obligations.

Identity documents and verification data submitted as part of the KYC process are shared with 67pak's third-party identity verification service providers for the purpose of document authentication and identity confirmation. These providers are contractually bound to process the data only for KYC purposes and to maintain appropriate security standards.

A session token and anonymised player identifier are shared with third-party game content providers (including Evolution Gaming, Pragmatic Play, NetEnt, Hacksaw Gaming, and others) to enable game delivery and to maintain game logs for dispute resolution purposes. These providers do not receive your name, CNIC, or contact details.

67pak is required by law to share data with competent regulatory authorities, financial intelligence units, and law enforcement agencies when required to do so by a valid legal obligation — including AML reporting requirements, court orders, and regulatory investigations. 67pak will comply with such requirements to the extent required by applicable law.

In the event that 67pak undergoes a merger, acquisition, or sale of all or a material part of its assets, personal data held by 67pak may be transferred to the acquiring entity as part of the transaction. In such circumstances, 67pak will notify affected users via their registered email address prior to the transfer taking effect, and the acquiring entity will be required to honour the commitments made in this Policy.

67pak's primary data infrastructure is hosted within data centres that meet internationally recognised security standards. In the course of operating the Platform — particularly in relation to game content delivery and KYC verification — personal data may be processed by third-party partners operating servers outside Pakistan. Where such transfers occur, 67pak ensures that appropriate contractual safeguards are in place to protect the security and integrity of your personal data during transfer and processing.

67pak does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards, including standard contractual clauses or binding corporate rules as applicable. Where you have a concern about the international transfer of your personal data, you may contact 67pak's Privacy team using the contact details in Section 15.

67pak retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory retention obligations. The following standard retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (which cannot reasonably be used to identify you) may be retained indefinitely for statistical and analytical purposes.

You have the following rights in respect of your personal data held by 67pak. To exercise any of these rights, please contact our Privacy team using the details in Section 15. 67pak will respond to valid requests within 30 days of receipt.

67pak uses first-party cookies and similar browser storage technologies to support the operation of the Platform. We do not use third-party advertising cookies or cross-site tracking technologies that share your browsing behaviour with external advertising networks.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent the functioning of the Platform. Disabling analytics cookies will not affect your ability to use any feature of the Platform. Instructions for managing cookies in common browsers (Chrome, Safari, Firefox, Edge) are available from those browsers' respective help documentation.

67pak may send you marketing communications about promotions, bonuses, new games, and Platform updates via email and SMS to your registered contact details. Marketing communications are sent only where you have given explicit consent during account registration or subsequently via your account settings.

You may opt out of marketing communications at any time by: (a) clicking the "Unsubscribe" link included in every marketing email; (b) replying STOP to any marketing SMS; or (c) updating your communication preferences in the Account Settings section of the Platform. Opting out of marketing communications will take effect within 5 business days. Opting out does not affect transactional and account management communications, which are sent regardless of marketing preferences.

67pak is not intended for use by individuals under 21 years of age. 67pak does not knowingly collect personal data from individuals under 21. Age verification is conducted as part of the KYC process. Where 67pak becomes aware that it has collected personal data from an individual under 21 years of age, that data will be deleted, the account will be closed, and any Real Money Balance will be returned to the depositing payment method. Bonus Balances will be forfeited.

If you believe that 67pak has collected personal data from an individual under 21 years of age, please contact our Privacy team immediately using the details in Section 15 so that the matter can be investigated and remediated.

67pak implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and 67pak servers is encrypted using TLS 1.2 or higher. Personal data stored in 67pak databases is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorised 67pak personnel on a need-to-know basis. Access logs are maintained and audited. Multi-factor authentication is required for administrative access to data systems.
• Secure Infrastructure: 67pak's data infrastructure is hosted in secure data centres with physical security controls, redundant power systems, and intrusion detection systems. Infrastructure configurations are hardened against known vulnerability classes.
• Security Audits: 67pak conducts regular security audits and penetration testing of the Platform. Vulnerabilities identified during audits are remediated in accordance with a risk-based prioritisation framework.
• Incident Response: 67pak maintains a data breach incident response protocol. In the event of a data breach that is likely to result in a risk to your rights and freedoms, 67pak will notify you and relevant authorities in accordance with applicable data protection law.

While 67pak implements robust security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your login credentials and for notifying 67pak immediately if you become aware of any unauthorised access to your account.

67pak reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. Material changes — including changes to the purposes for which data is collected, the categories of data collected, or the third parties with whom data is shared — will be communicated to registered users via email to the registered email address at least 14 days prior to the updated policy taking effect.

The date of the most recent update is displayed at the top of this Policy under "Effective Date". You are encouraged to review this Policy periodically. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the updated Policy. If you do not agree to any update, you must close your account in accordance with the Terms & Conditions prior to the updated policy taking effect.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 67pak, you may contact our Privacy team using the following methods:

• Email: [email protected] (please allow up to 5 business days for a response to privacy enquiries)
• Subject Access Requests: [email protected] — for formal data subject access requests under applicable data protection law
• Data Protection Concerns: [email protected] — for complaints or concerns regarding 67pak's data practices

67pak will acknowledge receipt of your privacy enquiry within 2 business days and will provide a substantive response within 30 days of receipt. Where your request is complex or requires retrieval of archived data, 67pak may extend the response period by an additional 30 days with written notice to you explaining the reason for the extension.

If you are not satisfied with 67pak's response to your privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. 67pak will cooperate fully with any regulatory investigation into its data practices.