badpkr Privacy Policy

This Privacy Policy ("Policy") describes how badpkr ("the Company", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "the Player") who access or use the badpkr platform, including the website at badpkr.org, all associated mobile experiences, gaming content, sports betting services, payment features, and customer support channels.

badpkr is Pakistan's premier online casino and sports betting platform, purpose-built for Pakistani players. Whether you are depositing via JazzCash from Karachi, placing a PSL bet from Lahore, or spinning the reels from Islamabad, your personal data is handled with the same level of care and diligence regardless of where in Pakistan you are located.

By registering an account on the badpkr platform, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

badpkr collects personal data from you in three main ways: data you provide directly when registering or using the platform, data collected automatically through your use of the platform, and data received from third parties such as payment providers and identity verification services.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile number, and a self-selected username and password;
• Identity verification (KYC) data: CNIC number, copies of valid identity documents (CNIC, passport, driving licence), and selfie verification images;
• Address data: Residential address, city (e.g. Karachi, Lahore, Faisalabad, Rawalpindi, Islamabad), and postcode where applicable;
• Financial data: JazzCash wallet number, EasyPaisa account details, HBL/UBL/Meezan bank account identifiers, and Raast IDs used for deposits and withdrawals;
• Communications: Records of your interactions with our support team via live chat, email correspondence, and any feedback or complaints you submit.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers;
• Usage data: Pages visited, games played, bets placed (including stake amounts and outcomes), session duration, login timestamps, and navigation paths;
• Location data: General geographic location derived from IP address (country and city level only — we do not collect precise GPS coordinates);
• Cookie data: Session cookies, preference cookies, and analytics data as described in Section 8 of this Policy.

2.3 Data from Third Parties

• Payment provider data: Transaction confirmation data, wallet status, and payment reference numbers from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK;
• Identity verification services: Verification outcomes and risk scores from our KYC and AML compliance partners;
• Fraud prevention services: Risk signals and fraud indicators from third-party fraud detection systems integrated into the badpkr platform.

badpkr uses your personal data only for specific, legitimate purposes that are directly connected to the operation of a safe, fair, and compliant online gaming platform for Pakistani players. We do not use your data for purposes that are incompatible with the reasons for which it was originally collected.

• Account management: To create, maintain, and manage your badpkr player account, including authentication and account security;
• Service delivery: To provide access to casino games, sports betting markets, and all associated platform features;
• Payment processing: To process deposits and withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK in Pakistani Rupees (PKR);
• Identity verification: To verify your identity and age (21+) in compliance with our KYC obligations and to prevent underage gambling;
• Legal and regulatory compliance: To comply with applicable anti-money laundering (AML) obligations, licensing conditions, and any lawful requests from regulatory authorities;
• Fraud prevention: To detect, investigate, and prevent fraudulent transactions, bonus abuse, account takeovers, and other prohibited activities;
• Responsible gaming: To monitor gaming behaviour and identify patterns that may indicate problem gambling, allowing us to apply appropriate responsible gaming interventions such as deposit limit suggestions or self-exclusion prompts;
• Customer support: To respond to your queries, complaints, and support requests efficiently and accurately;
• Platform improvement: To analyse usage data and improve the performance, reliability, and features of the badpkr platform;
• Marketing communications: To send you promotional offers, bonus notifications, and relevant platform updates — only where you have provided your consent to receive such communications, which you may withdraw at any time.

badpkr processes your personal data on one or more of the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing required to perform the contract between you and badpkr — i.e. operating your player account, processing your deposits and withdrawals, and delivering gaming services;
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC identity verification, AML transaction monitoring, and licensing requirements;
• Legitimate interests: Processing carried out for badpkr's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, and responsible gaming monitoring;
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily in the context of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

badpkr does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your personal data only in the specific circumstances described below, and only to the minimum extent necessary for each purpose.

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK receive the transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy policy and data protection obligations;
• KYC and identity verification partners: Your identity documents and verification data are shared with our regulated KYC compliance partners solely for the purpose of verifying your identity and age in accordance with our licensing obligations;
• Fraud prevention and AML services: Transaction data and risk indicators are shared with our fraud detection and AML monitoring partners to detect and prevent financial crime on the platform;
• Game content providers: Where technically required for game functionality, limited session and stake data may be shared with our certified game content providers. These providers are not permitted to use this data for any purpose beyond delivering the game service;
• Regulatory and legal authorities: We may disclose your personal data to relevant regulatory authorities, law enforcement agencies, or courts where we are legally required to do so or where disclosure is necessary to protect the rights, property, or safety of badpkr, its players, or the public;
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of badpkr's business, your personal data may be transferred to the relevant successor entity, subject to the same privacy protections described in this Policy.

badpkr retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve any disputes that may arise. The specific retention periods applicable to different categories of data are as follows:

Upon expiry of the applicable retention period, your personal data is securely deleted or anonymised in a manner that ensures it can no longer be associated with you as an individual.

badpkr implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure is designed to meet the standards expected of a regulated financial and gaming platform.

• 256-bit SSL/TLS encryption: All data transmitted between your device and the badpkr platform is encrypted using industry-standard 256-bit SSL/TLS protocols — the same standard used by Pakistan's major commercial banks;
• Encrypted data storage: Personal and financial data held in our databases is encrypted at rest using AES-256 encryption;
• Access controls: Access to personal data is strictly limited to badpkr employees and contractors who require it to perform their job functions. All access is logged, audited, and subject to regular review;
• Two-factor authentication: Player accounts support two-factor authentication (2FA) via SMS OTP. We strongly encourage all badpkr players to enable 2FA from their account security settings;
• Intrusion detection: Our platform is monitored 24/7 by automated intrusion detection systems that flag and escalate suspicious activity in real time;
• Regular security audits: The badpkr platform undergoes regular independent security penetration testing and vulnerability assessments.

badpkr uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, and understand how players use our services. A cookie is a small text file placed on your device when you visit the badpkr website. Cookies do not contain executable code and cannot access other data on your device.

8.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the platform to function correctly. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled without impairing platform functionality;
• Preference cookies: Remember your language settings, display preferences, and responsible gaming tool configurations so you do not have to re-enter them each session;
• Analytics cookies: Collect anonymised data about how players navigate and use the badpkr platform. This data is used to improve platform performance, identify usability issues, and prioritise feature development;
• Security cookies: Used to detect and prevent fraudulent activity, including CSRF protection tokens and bot-detection signals.

8.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to receive a notification before a cookie is stored. Please note that disabling strictly necessary cookies will significantly impair your ability to use the badpkr platform. Instructions for managing cookies in the most common browsers (Chrome, Firefox, Safari, Edge) are available via each browser's help documentation.

badpkr handles payment data with the highest level of care, given the sensitive financial nature of this information. We process deposits and withdrawals exclusively through Pakistan's established payment infrastructure — JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK — all of which are regulated entities operating under State Bank of Pakistan (SBP) oversight.

The following principles govern how badpkr handles your payment data:

• badpkr does not store complete bank account numbers or full card numbers on its own servers. Payment credentials are tokenised and processed through the secure infrastructure of the respective payment provider;
• All financial transaction records are encrypted at rest and in transit;
• Withdrawal payments are made exclusively to payment methods registered in your own name, consistent with our AML obligations. We will never process a withdrawal to a third-party account;
• Transaction records are retained for five years in line with financial compliance requirements, after which they are securely deleted;
• badpkr's AML monitoring systems may flag unusually large or structured transactions for manual review. In such cases, we may contact you to request source-of-funds documentation before processing the transaction.

badpkr respects your rights over your own personal data. The following rights are available to all registered badpkr players in relation to their personal data held by the Company:

• Right of access: You may request a copy of all personal data badpkr holds about you. We will provide this within a reasonable timeframe, free of charge for standard requests;
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may update most account details directly through your badpkr account settings;
• Right to erasure ("right to be forgotten"): You may request that badpkr delete your personal data. We will action this request where it is not overridden by our legal obligation to retain data (e.g. AML and licensing retention requirements);
• Right to restriction: You may request that badpkr restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds;
• Right to data portability: You may request a copy of personal data you have provided to badpkr in a structured, machine-readable format, for the purpose of transferring it to another service provider;
• Right to object: You have the right to object to processing of your personal data based on badpkr's legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time;
• Right to withdraw consent: Where processing is based on your consent (primarily marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact the badpkr support team via live chat or at [email protected]. We will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

The badpkr platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21, and we actively enforce our age verification requirements through our KYC programme. Age verification is a mandatory step that all players must complete before their first withdrawal is processed.

If badpkr becomes aware that personal data has been collected from an individual under the age of 21, we will take the following steps immediately:

• The relevant account will be closed immediately and all activity voided;
• All personal data associated with the underage account will be permanently deleted from our systems, subject to any legal retention obligations;
• Any original deposit amount will be refunded via the original payment method;
• The incident will be reported to the relevant regulatory authority where required by law.

badpkr reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, regulatory requirements, or platform features. We are committed to communicating any material changes to you in a clear and timely manner.

When we make material changes to this Policy, we will:

• Post the updated Policy on this page with a revised effective date clearly displayed at the top;
• Display a prominent notification on the badpkr platform for a period of at least 14 days following the change;
• Send an email notification to the address registered on your badpkr account for any changes that materially affect your rights or the way we process your personal data.

Your continued use of the badpkr platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the platform and may request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way badpkr handles your personal data, please do not hesitate to get in touch. Our data privacy team is reachable through any of the following channels:

• Live chat: Available 24/7 directly on the badpkr platform — average response time under 2 minutes;
• Email: [email protected] — for detailed written queries or formal data rights requests;
• Postal correspondence: For formal legal notices, written correspondence may be submitted through the contact details provided in our Terms & Conditions document.

When submitting a data rights request, please include your registered badpkr username and the email address associated with your account to help us locate your records promptly. We may ask for additional identity verification before processing certain sensitive requests, such as data access or erasure, to protect your account security.