22pak Privacy Policy — How We Handle Your Personal Data

1.1 For the purposes of this Privacy Policy, the data controller is the company operating the 22pak platform at 22pak.net (referred to throughout this Policy as "22pak", "we", "us", or "our"). 22pak operates under an international gaming license and is subject to data protection obligations imposed by that licensing framework.

1.2 22pak's primary data processing activities relate to the provision of online sports betting, live casino gaming, slot gaming, instant-win titles, and associated account, payment, and customer support services to registered players — the majority of whom are based in Pakistan.

1.3 This Privacy Policy applies to all personal data collected by 22pak in connection with player registration, account management, financial transactions, gaming activity, customer support interactions, and visits to 22pak.net whether by registered players or unregistered visitors.

2.1 22pak collects the following categories of personal data from registered players and, where indicated, from unregistered visitors to 22pak.net:

2.2 22pak does not deliberately collect special category personal data (such as racial or ethnic origin, political opinions, or health data) unless a player voluntarily discloses such information in a support interaction, in which case it is processed only for the immediate purpose of the interaction and not retained in the player's primary data profile.

3.1 22pak collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, or contacting customer support.
• Platform activity: Data generated automatically as a result of your use of the 22pak Platform — including bets placed, games played, login events, and session duration.
• Automated technical collection: Data collected via cookies, web beacons, server logs, and similar tracking technologies when you visit 22pak.net. See Section 9 for full cookie details.
• Third-party verification providers: Identity and document verification results returned by 22pak's KYC service provider when you submit identity documents.
• Payment processors: Transaction confirmation data from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 network confirmation data.
• Fraud and AML screening: Risk signals and watchlist screening results from licensed third-party fraud prevention and anti-money laundering compliance providers.

4.1 22pak processes your personal data for the following primary purposes:

• Account administration: Creating, maintaining, and managing your 22pak account including login authentication, password management, and VIP tier tracking.
• Payment processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 in PKR.
• Identity verification (KYC): Verifying your identity and age in compliance with 22pak's international gaming license requirements.
• Fraud detection and AML compliance: Monitoring account and transaction activity for signs of fraudulent conduct, money laundering, or other financial crime.
• Responsible gaming monitoring: Identifying indicators of problem gambling behaviour, applying responsible gaming tools, and maintaining self-exclusion and limit records.
• Customer support: Responding to queries, complaints, and responsible gaming tool requests received via live chat or email.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the performance, usability, and game selection of the 22pak Platform.
• Regulatory compliance: Meeting reporting, record-keeping, and audit obligations imposed by 22pak's international gaming licensing authority.
• Promotional communications: Sending you information about 22pak bonuses, promotions, and account updates via your registered mobile number, where you have not opted out of such communications.

4.2 22pak does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review, except in the limited context of fraud risk scoring during payment processing — where any resulting account action is reviewed by a human operator before being applied.

5.1 22pak processes your personal data under the following legal bases:

• Contractual necessity: Processing required to provide the services you have registered for — including account management, game access, deposit and withdrawal processing, and customer support.
• Legal obligation: Processing required to comply with 22pak's obligations under its international gaming license, including KYC verification, AML monitoring, responsible gaming record-keeping, and regulatory reporting.
• Legitimate interests: Processing for fraud detection, platform security, and analytics based on 22pak's legitimate interest in maintaining the integrity and security of its platform — provided those interests are not overridden by your data protection rights.
• Consent: Processing for promotional communications, where your consent was obtained at registration or subsequently. You may withdraw this consent at any time via the account settings or by contacting support.

6.1 22pak does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Data sharing is limited to the following categories of recipients, all of whom are required to process your data only for the specific purpose for which it was shared and under binding data processing agreements:

7.1 As an international gaming platform operating under a cross-jurisdictional license, some of 22pak's data processing activities — particularly those involving game content providers, KYC verification services, and AML screening providers — involve the transfer of personal data to countries outside Pakistan.

7.2 Where personal data is transferred internationally, 22pak ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that applied within 22pak's own systems. These safeguards include contractual data processing agreements incorporating standard data protection clauses, and the use of providers who are independently certified under recognised data protection frameworks.

7.3 22pak's primary data storage infrastructure is located in data centres operating under the oversight of 22pak's licensing jurisdiction. Personal data is not transferred to jurisdictions with no applicable data protection framework without specific safeguards being applied.

8.1 22pak retains personal data only for as long as is necessary for the purposes for which it was collected, subject to longer retention periods required by regulatory obligations. The following retention periods apply:

8.2 On expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an individual player. Anonymised, aggregated data may be retained indefinitely for platform analytics purposes.

9.1 22pak uses cookies and similar tracking technologies (including web beacons and local storage objects) on 22pak.net. Cookies are small text files stored on your device by your browser that help the Platform function correctly and allow 22pak to understand how players use the site.

9.2 22pak uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication, login state maintenance, and security tokens. These cannot be disabled without preventing access to the Platform.
• Analytics Cookies: Used to collect anonymised data on how visitors navigate 22pak.net — including pages visited, time on page, and entry/exit points. This data is used in aggregate only to improve the Platform.
• Security & Fraud Prevention Cookies: Used to identify suspicious patterns, detect bot activity, and protect against credential stuffing and other automated attacks on player accounts.
• Preference Cookies: Used to remember your display preferences, language settings, and responsible gaming notification configurations between sessions.

9.3 22pak does not use third-party advertising cookies or behavioural tracking cookies that profile you across websites for ad-targeting purposes.

9.4 Specific cookies used on 22pak.net include:

9.5 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent access to account features. Disabling analytics cookies will not affect Platform functionality. A cookie management interface is accessible via the footer of 22pak.net.

10.1 As a data subject whose personal data is processed by 22pak, you have the following rights. Requests to exercise these rights should be submitted to 22pak via the contact details in Section 15:

10.2 Please note that certain rights — particularly the right to erasure — may be limited where 22pak has a legal obligation to retain the data in question (for example, KYC and transaction records subject to regulatory retention requirements as described in Section 8).

11.1 22pak implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and 22pak.net is encrypted using TLS 1.2 or higher (256-bit SSL). This includes all login, payment, and account management communications.
• Encryption at rest: Personal data stored in 22pak's databases — including identity documents, payment account references, and gaming history — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within 22pak's internal systems is restricted on a strict need-to-know basis. All internal access events are logged and audited.
• Two-factor authentication: 22pak's internal administrative systems require multi-factor authentication. Players are encouraged to enable two-factor authentication on their own 22pak accounts via account settings.
• Penetration testing: 22pak's Platform undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Breach notification: In the event of a personal data breach that poses a risk to players, 22pak will notify affected players via their registered mobile number without undue delay and will report the breach to the relevant supervisory authority as required by its licensing obligations.

11.2 While 22pak takes all reasonable technical and organisational precautions to protect your data, no system is entirely immune to security risks. You are also responsible for maintaining the security of your own account credentials — including your password and OTP codes. 22pak will never ask you for your password via any communication channel.

12.1 The 22pak Platform is strictly restricted to individuals aged 21 years or older. 22pak does not knowingly collect personal data from any person under the age of 21. Registration is technically restricted by an age declaration at the point of account creation, and age is verified through the KYC process at the point of first substantial withdrawal.

12.2 If 22pak becomes aware — through KYC verification, a third-party report, or any other means — that personal data has been collected from a person under the age of 21, the following actions will be taken immediately:

1. The relevant account will be suspended pending investigation;
2. All personal data associated with the underage account will be deleted to the extent permitted by legal obligations;
3. Any real-money deposits made by the underage player will be returned to the payment method used, after deduction of any winnings (which are not eligible for payment to underage players);
4. The incident will be reported to 22pak's licensing authority in accordance with applicable regulatory requirements.

12.3 Parents or guardians who believe that a person under 21 in their care has registered an account on 22pak are encouraged to contact 22pak's support team immediately via live chat or the email address provided in Section 15.

13.1 The 22pak Platform may contain references to third-party services — for example, game content provided by live dealer studio operators or slot game providers. While 22pak carefully selects its content provider partners, it does not control the privacy practices of those third parties and is not responsible for their data handling beyond the obligations imposed by 22pak's data processing agreements with those providers.

13.2 22pak does not host external links to third-party websites for general browsing purposes. All links on 22pak.net lead to 22pak's own pages or to 22pak's own game content. However, where third-party tools (such as KYC verification widgets) are embedded in the Platform, those tools operate under their providers' own privacy policies in addition to 22pak's processing instructions.

14.1 22pak reserves the right to update this Privacy Policy at any time to reflect changes in legal requirements, regulatory obligations, Platform features, or data processing practices. The effective date at the top of this Policy reflects the date of the most recent revision.

14.2 Where changes to this Policy are material — meaning they significantly affect how 22pak processes your personal data or alter your rights — 22pak will notify registered players via their registered mobile number at least seven (7) days before the changes take effect.

14.3 Your continued use of the 22pak Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree with the changes, you must cease using the Platform and may request account closure in accordance with 22pak's Terms & Conditions, available at 22pak.net/terms-conditions.

14.4 Prior versions of this Privacy Policy are available on request by contacting 22pak's support team. The current version is always accessible at 22pak.net/privacy-policy.

15.1 For any privacy-related query, data rights request, or complaint regarding 22pak's data processing practices, please contact 22pak through the following channels:

• Live Chat: Available daily 9:00 AM – 2:00 AM Pakistan Standard Time. Access via the support widget on 22pak.net. For privacy matters, state "Privacy Request" at the start of your chat session.
• Email: [email protected] — subject line: "Privacy Policy Query" or "Data Rights Request". This is a plain-text address and is not a clickable link.

15.2 All privacy requests and complaints received by 22pak will be acknowledged within 48 hours and responded to substantively within 30 calendar days. Where a response requires longer than 30 days due to complexity, 22pak will notify the player of the extended timeline and the reason for it.

15.3 If you are not satisfied with 22pak's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority or to the dispute resolution body designated by 22pak's gaming licensing authority. 22pak will provide the contact details of the applicable authority upon request.