37pk Privacy Policy — How We Collect, Use, and Protect Your Data

This Privacy Policy is issued by 37pk, the operator of the online sportsbook and casino platform accessible at 37pk.org (referred to in this document as "37pk," "we," "us," or "our"). 37pk operates under an international gaming licence and is the data controller in respect of personal data collected from players who register and use the 37pk platform.

As data controller, 37pk determines the purposes and means by which personal data is processed. Where 37pk engages third-party service providers to process data on its behalf — such as payment processors and game providers — those parties act as data processors operating under contractual instructions from 37pk and are not permitted to use your data for their own independent purposes.

For all privacy-related enquiries, data subject requests, or complaints regarding 37pk's data handling practices, please contact: support [at] 37pk.org — or reach out via live chat available on the 37pk platform.

37pk collects the following categories of personal data from players, depending on the nature of their interaction with the platform:

37pk collects personal data through the following channels:

• Directly from you: Information you provide during account registration, identity verification (KYC), payment processing, responsible gaming tool activation, and communications with 37pk's customer support team.
• Automatically: Technical data including IP addresses, device identifiers, and session logs are collected automatically when you access the 37pk platform, whether through the website at 37pk.org or the 37pk mobile application. This collection is standard for all online platforms and is necessary for platform security and fraud prevention.
• From payment providers: When you initiate a deposit or withdrawal, 37pk's integrated payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or USDT network processors) provide 37pk with transaction confirmation data necessary to credit or debit your account. 37pk does not receive your payment provider credentials or passwords.
• From identity verification services: During KYC processing, 37pk may use third-party identity verification services that return a verification result and a confidence score. The underlying identity data you submit (CNIC images, selfie) is handled under strict data processing agreements.
• Through cookies and similar technologies: As detailed in Section 8 of this policy, 37pk uses cookies and similar tracking technologies to maintain session state, prevent fraud, and improve platform functionality.

37pk processes personal data only where there is a lawful basis for doing so. The following table sets out the primary purposes for which 37pk processes personal data and the corresponding legal basis in each case:

Where 37pk processes data based on legitimate interests, those interests have been assessed against your rights and interests. If you wish to challenge any such assessment or object to processing on legitimate interest grounds, please contact 37pk via the details in Section 14.

37pk does not sell your personal data. Your data is shared with third parties only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processing partners receive the minimum transaction data required to execute deposits and withdrawals. These processors have their own privacy policies and operate under separate regulatory frameworks.
• KYC and identity verification providers: Third-party services engaged by 37pk to assist with identity document verification during the KYC process. These providers act as data processors and are bound by strict data processing agreements prohibiting independent use of player data.
• Game providers: Licensed game providers whose titles are accessible on the 37pk platform (including live casino studio operators) may receive a player session identifier for the purpose of delivering the game. They do not receive your full identity data unless required for regulatory compliance specific to their own licensing.
• Regulatory authorities: 37pk is required under its international gaming licence to provide player data to its regulator upon request, and to report suspicious transaction activity to relevant financial intelligence units as required by applicable anti-money-laundering obligations.
• Legal and law enforcement: 37pk may disclose personal data to law enforcement or courts where required by a valid legal instrument, court order, or applicable law.
• Fraud prevention networks: Where 37pk identifies that an account has engaged in fraudulent conduct, relevant account information may be shared with industry-wide fraud prevention databases to protect other operators and players.

The 37pk platform is operated under an international gaming licence, and some of the third-party service providers engaged by 37pk — including game providers, identity verification services, and platform infrastructure providers — may process personal data in jurisdictions outside Pakistan. Where such international transfers occur, 37pk ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections afforded by the data handling requirements under 37pk's licensing framework.

Such safeguards typically include contractual clauses requiring the recipient to handle data in accordance with internationally recognised data protection standards, binding the recipient to security obligations consistent with those applied by 37pk itself. Where you have questions about the safeguards in place for a specific international transfer, please contact 37pk via the details in Section 14 and we will provide relevant information within a reasonable timeframe.

37pk retains personal data for as long as necessary to fulfil the purposes described in this policy, and in any event for no longer than required by applicable regulatory obligations. The following general retention principles apply:

• Active account data: Maintained for the duration of your active 37pk account relationship and for a period of at least five years following account closure, in accordance with anti-money-laundering regulatory requirements applicable to licensed gaming operators.
• KYC documentation: Retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later, as required under financial crime prevention obligations applicable to 37pk's gaming licence.
• Transaction records: Deposit, withdrawal, and betting records are retained for a minimum of five years. These records form part of 37pk's regulatory compliance obligations and cannot be deleted at player request during the mandatory retention period.
• Support communications: Live chat transcripts and email correspondence are retained for up to three years following the resolution of the relevant interaction, or longer where the communication is relevant to an ongoing dispute or compliance matter.
• Marketing consent records: Records of consent to marketing communications are retained for as long as required to demonstrate compliance with consent obligations, typically throughout the account relationship and for one year post-closure.
• Anonymised analytics data: Aggregated, anonymised data that cannot be linked back to any individual player may be retained indefinitely for product improvement and statistical purposes.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with 37pk's data deletion procedures.

The 37pk platform uses cookies and similar technologies to provide a functional, secure, and personalised experience. Cookies are small text files stored on your device by your browser when you visit 37pk.org. The categories of cookies used on 37pk are as follows:

• Strictly necessary cookies: Essential for core platform functions including session management, login state, and security token handling. These cookies cannot be disabled without breaking core platform functionality and do not require consent.
• Functional cookies: Remember your preferences such as language settings and game lobby display options. These cookies improve convenience but are not strictly necessary.
• Security and fraud prevention cookies: Used to detect suspicious behaviour, identify bot activity, and protect the integrity of the 37pk platform and its players.
• Analytics cookies: Used to understand how players navigate the 37pk platform, which features are most used, and where usability improvements are needed. Analytics data is processed at an aggregated level wherever possible. These cookies require your consent.

You may control cookie settings through your browser preferences. Note that disabling strictly necessary cookies may prevent the 37pk platform from functioning correctly. 37pk's cookie implementation is reviewed periodically to ensure it remains proportionate and necessary.

You have the following rights in respect of the personal data 37pk holds about you. To exercise any of these rights, please contact 37pk via live chat or email at support [at] 37pk.org with the subject line "Data Rights Request." 37pk will acknowledge your request within 72 hours and respond substantively within 30 days.

37pk implements a layered security architecture to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. The key technical and organisational measures in place include:

• Encryption in transit: All data transmitted between your device and 37pk's servers is encrypted using TLS (Transport Layer Security). This applies to the 37pk website, mobile application, and all API communications used by payment processors and game providers.
• Encryption at rest: Sensitive personal data including identity documents and financial records stored on 37pk's infrastructure is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within 37pk's systems is restricted to authorised personnel on a strictly need-to-know basis. All internal access to player data is logged and subject to periodic audit review.
• Password security: 37pk stores account credentials using secure cryptographic hashing. Plaintext passwords are never stored. Account holders are encouraged to use strong, unique passwords and to enable two-factor authentication for additional protection.
• Security monitoring: 37pk's platform infrastructure is subject to continuous security monitoring, intrusion detection, and periodic penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that poses a material risk to player data, 37pk will take immediate containment measures and notify affected players and relevant regulatory authorities within the timeframes required by applicable obligations.

37pk is strictly an adult platform. The minimum age requirement for all 37pk accounts is 21 years. 37pk does not knowingly collect personal data from individuals under the age of 21. The date of birth provided at registration is used as the first line of age verification, and KYC document review confirms age before large withdrawals are processed.

If 37pk identifies or has reasonable grounds to believe that personal data has been collected from an individual under 21, the relevant account will be closed immediately, all activity on the account will be reviewed, and data collected in connection with the account will be handled in accordance with applicable regulatory requirements for underage gambling incidents, which may include retention for compliance purposes rather than deletion.

Parents and guardians who believe that a minor has registered on 37pk should contact support immediately via live chat or email. 37pk takes such reports seriously and will investigate and act promptly.

Data relating to your use of 37pk's responsible gaming tools — including deposit limits, session time settings, cool-off periods, and self-exclusion — is treated with a heightened level of care. This data is used solely to operate the responsible gaming framework in your interest and for 37pk's regulatory compliance obligations. It is not used for marketing profiling or shared with third parties except where required by 37pk's gaming licence regulator.

Self-exclusion records are maintained for the full duration of the exclusion period and for a period thereafter as required by regulatory obligations. Self-excluded players cannot be re-registered until the exclusion period has expired and the formal re-registration process has been completed — even where a player requests re-access during the exclusion period, that request will be declined to protect the player's interests.

If you are concerned about your gambling behaviour and wish to access 37pk's responsible gaming tools, please visit the Responsible Gaming page or contact support directly via live chat for immediate assistance.

37pk reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. The effective date shown at the top of this document indicates when the current version came into force.

Material changes to this Privacy Policy — particularly those that affect how your personal data is used or your rights over it — will be communicated to registered players via in-platform notification. For less material changes, the updated policy will be posted at 37pk.org/privacy-policy with an updated effective date.

Continued use of the 37pk platform following notification of a material policy change constitutes acceptance of the revised Privacy Policy. If you do not agree with any updated provisions, you should cease using the platform and request account closure via 37pk support, ensuring withdrawal of any remaining funds before closure.

For all privacy-related matters, including data subject rights requests, questions about this Privacy Policy, or complaints about 37pk's data handling practices, please use the following contact channels:

• Live Chat: Available 24/7 directly inside the 37pk platform. For urgent privacy concerns — including suspected unauthorised account access or data breach reports — live chat is the fastest channel, with response times typically under two minutes.
• Email: support [at] 37pk.org — for formal data rights requests, please include "Data Rights Request" in the subject line along with your registered username and a description of your request. 37pk will acknowledge within 72 hours and respond substantively within 30 days.

If you are not satisfied with 37pk's handling of a privacy complaint after raising it through the above channels, you may escalate the matter to the relevant supervisory authority under 37pk's international gaming licence framework. Details of the applicable regulatory authority are available on request from the 37pk support team.

37pk is committed to resolving privacy complaints promptly and fairly. All formal privacy complaints are logged, investigated, and responded to in writing. 37pk's internal privacy complaint procedure does not affect any statutory rights you may have under applicable data protection law in your jurisdiction.