98kr Privacy Policy

This Privacy Policy ("Policy") is issued by 98kr ("98kr", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "User") who access, register on, or otherwise interact with the 98kr online gaming and sports betting platform available at 98kr.net and all associated subdomains and interfaces.

98kr operates as an internationally licensed online gaming platform primarily serving Pakistani users. The platform offers casino games, live dealer tables, fishing games, slot titles, and sports betting — all denominated in Pakistani Rupees (PKR) and accessible through Pakistani payment channels including JazzCash, EasyPaisa, Raast, and major Pakistani banks.

Given the nature of our services, 98kr is required under its international gaming licence to collect and process personal data for identity verification, age verification, anti-money laundering (AML) compliance, and responsible gaming purposes. This Policy explains how we do this lawfully, transparently, and with appropriate safeguards in place.

By using the 98kr Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the 98kr Platform.

98kr is the data controller responsible for the personal data collected and processed through the 98kr Platform. As data controller, 98kr determines the purposes and means of processing your personal data and is accountable for ensuring that such processing is conducted lawfully and in accordance with this Policy and applicable data protection law.

Where 98kr engages third-party service providers to process personal data on its behalf — such as KYC verification providers, payment processors, or cloud infrastructure providers — those providers act as data processors under contract with 98kr, processing data solely on 98kr's documented instructions and subject to appropriate data protection obligations.

98kr collects the following categories of personal data, depending on how you interact with the Platform:

98kr collects personal data through the following channels and methods:

• Direct provision by you: Data you actively provide during account registration, KYC submission, deposit and withdrawal requests, customer support interactions, and when updating your account settings.
• Automated collection: Technical and usage data collected automatically when you access the 98kr Platform, including IP addresses, device identifiers, session information, and navigation data collected via server logs, cookies, and similar technologies.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, Raast, 1LINK, and banking partners when processing deposits and withdrawals to and from your 98kr account.
• KYC and identity verification providers: Verification status and screening results received from third-party KYC providers when processing your identity verification submission.
• Fraud prevention and AML screening services: Risk signals and screening results from third-party fraud prevention and anti-money laundering compliance services.

98kr processes your personal data only where a valid legal basis exists. The primary legal bases on which 98kr relies are as follows:

• Contractual necessity: Processing required to fulfil our contract with you — including operating your account, processing deposits and withdrawals, and delivering gaming and betting services — is carried out on the basis that it is necessary for the performance of our agreement with you.
• Legal obligation: 98kr is required under its international gaming licence and applicable AML, KYC, and responsible gaming regulatory obligations to collect, process, and retain certain categories of personal data. Processing for these purposes is carried out to comply with legal obligations to which 98kr is subject.
• Legitimate interests: 98kr processes certain data — including fraud detection, security monitoring, platform improvement, and responsible gaming analysis — on the basis of its legitimate interests in protecting the integrity of the Platform and its users, provided those interests are not overridden by your rights and interests.
• Consent: Where processing is not otherwise justified on the bases above — specifically for non-essential cookies and direct marketing communications — 98kr will seek your specific, informed, and freely given consent prior to processing. You may withdraw consent at any time without affecting the lawfulness of prior processing.

98kr uses the personal data we collect for the following purposes:

• Account creation and management: To register your 98kr account, maintain your profile, manage your PKR balance, and provide you with access to all Platform features.
• Identity and age verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with 98kr's KYC obligations under its international gaming licence. This is mandatory before any withdrawal from a 98kr account.
• Payment processing: To facilitate PKR deposits via JazzCash, EasyPaisa, Raast, and other supported payment channels, and to process withdrawal requests to your verified payment account.
• Game and betting service delivery: To record and process game sessions, betting activity, and wagers; to calculate and credit winnings; and to manage bonus wagering progress and eligibility.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent account activity, multiple account registrations, bonus abuse, money laundering, and other prohibited conduct, using automated tools and human review where appropriate.
• Responsible gaming compliance: To monitor for patterns of play that may indicate problem gambling; to enforce self-exclusion requests, deposit limits, and loss limits; and to comply with responsible gaming obligations under 98kr's licence.
• Customer support: To respond to your enquiries, investigate complaints, resolve disputes, and maintain support records.
• Legal and regulatory compliance: To comply with requests from our licensing authority, law enforcement agencies, tax authorities, and other competent regulatory bodies.
• Platform improvement: To analyse usage patterns and player behaviour in aggregate to improve game offerings, platform performance, and user experience — including testing and developing new features.
• Marketing communications (with your consent): To send you relevant promotional offers, bonus notifications, and platform updates where you have consented to receive such communications.

98kr does not sell, rent, or trade your personal data to any third party for their independent commercial use. We share personal data only in the following circumstances and with the following categories of recipients:

• KYC and identity verification providers: Identity data and CNIC documentation are shared with contracted third-party KYC verification services for the purpose of completing your identity and age verification. These providers act as data processors under contract with 98kr.
• Payment processors: Financial data necessary to process transactions is shared with JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, and GrabPay as required to execute deposit and withdrawal instructions. These entities process data under their own applicable privacy terms in addition to their contractual obligations to 98kr.
• AML and fraud prevention services: We may share certain identity and transaction data with contracted AML screening, fraud detection, and risk management service providers to fulfil our compliance obligations.
• Licensing authority: 98kr is required to provide our licensing authority with access to certain player data and transaction records as part of ongoing regulatory supervision and audit processes.
• Law enforcement and regulatory authorities: Where required by applicable law, court order, or direction from a competent authority, 98kr will disclose personal data to law enforcement agencies, regulatory bodies, or government authorities. 98kr will notify affected users of such disclosures where legally permitted to do so.
• Professional advisers: In connection with legal proceedings, audits, or professional advice, data may be shared with lawyers, auditors, and other professional advisers under strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of 98kr's business, personal data may be transferred to the relevant successor entity, subject to that entity being bound by terms at least as protective as this Policy.

As an internationally licensed gaming platform, 98kr may transfer your personal data to countries outside Pakistan for the purposes described in this Policy — including to our licensing jurisdiction, cloud infrastructure providers, and contracted KYC and AML service providers whose infrastructure may be located in various jurisdictions.

Where personal data is transferred internationally, 98kr ensures that appropriate safeguards are in place to protect that data, including:

• Standard contractual clauses or equivalent data transfer mechanisms with recipient organisations;
• Transfers to jurisdictions that provide an adequate level of data protection in the assessment of 98kr's licensing authority;
• Binding corporate rules or equivalent intra-group transfer mechanisms where applicable.

98kr retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 98kr's data disposal procedures. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and analytical purposes.

98kr implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and 98kr servers is encrypted using TLS 1.2 or TLS 1.3 protocols. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Personal data and financial records stored on 98kr's infrastructure are encrypted using AES-256 encryption.
• Access controls: Access to personal data within 98kr's systems is strictly role-based. Employees and contractors access only the data necessary for their specific function. Privileged access is subject to multi-factor authentication requirements and quarterly access reviews.
• Audit logging: All access to personal data records is logged and subject to automated anomaly detection. Logs are retained and periodically reviewed as part of 98kr's internal security audit programme.
• Penetration testing: 98kr conducts regular third-party penetration testing of its web application and infrastructure. Critical vulnerabilities identified through testing are remediated on a priority basis.
• Incident response: 98kr maintains a documented data breach incident response plan. In the event of a security incident that poses a risk to user data, 98kr will notify affected users and relevant regulatory authorities in accordance with applicable notification obligations.

98kr uses cookies and similar technologies on the Platform. Cookies are small data files stored on your device that enable certain Platform functionality and help us understand how users interact with our services.

98kr uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your 98kr account during a browsing session. These cookies cannot be disabled without preventing core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations. These enhance your 98kr experience and are enabled by default but can be disabled via browser settings.
• Analytics cookies: Collect anonymised data about how users navigate the Platform — including pages visited, time on page, and navigation paths — to help 98kr improve usability and performance. These are optional and require your consent.
• Security cookies: Used for fraud detection purposes, including identifying suspicious login patterns and bot activity. These are strictly necessary and cannot be disabled.

You can manage cookie preferences through your browser settings. Most browsers allow you to view, block, and delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in to your 98kr account.

As a user of the 98kr Platform, you have the following rights with respect to your personal data. To exercise any of these rights, contact 98kr at [email protected] with "Privacy" in the subject line:

• Right of access: You have the right to request a copy of the personal data 98kr holds about you, together with information about how it is used and shared. 98kr will respond to verified subject access requests within 30 days.
• Right to rectification: If any personal data held by 98kr is inaccurate or incomplete, you have the right to request that it be corrected or completed. Some data — particularly KYC identity data — may require re-submission of documentation to update.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where it has been unlawfully processed. This right is subject to overriding retention obligations under AML regulation and gaming licence requirements, which may prevent full deletion.
• Right to restriction: You may request that processing of your data be restricted in certain circumstances — for example, while the accuracy of data is being verified or a processing objection is being assessed.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes, where you have grounds relating to your particular situation. You may also object to direct marketing at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal.

98kr may send you promotional communications — including information about bonuses, new game releases, PSL betting promotions, and platform updates — where you have provided your consent to receive such communications at the time of registration or subsequently via your account settings.

98kr's marketing communications are delivered by email and/or SMS to your registered contact details. We do not engage in unsolicited telephone marketing calls.

You may withdraw your marketing consent and unsubscribe from all promotional communications at any time by:

• Clicking the unsubscribe link included in any marketing email from 98kr;
• Updating your communication preferences in your 98kr account settings; or
• Contacting 98kr support at [email protected] requesting removal from all marketing lists.

Withdrawal of marketing consent will not affect your ability to receive transactional and account-related communications — including deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — which are sent as part of the contractual relationship between you and 98kr and cannot be individually opted out of while your account remains active.

The 98kr Platform is strictly restricted to individuals who are at least 21 years of age. 98kr does not knowingly collect, process, or retain personal data from individuals under the age of 21. The Platform contains no content directed at or intended for minors.

If you are a parent or guardian and believe that a minor has created an account on 98kr or provided personal data to 98kr, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

The 98kr Platform may contain links to third-party websites, game providers, or payment service providers whose privacy practices differ from those of 98kr. This Privacy Policy applies solely to personal data collected by 98kr through the 98kr Platform.

When you interact with third-party services — including game providers whose games are embedded on the 98kr Platform, or payment processors such as JazzCash and EasyPaisa — those third parties may collect personal data directly from you subject to their own privacy policies. 98kr is not responsible for the privacy practices of those third parties.

We recommend that you read the privacy policy of any third-party service you interact with before providing personal data to that service.

98kr reserves the right to amend or update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or operational needs. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision.

Where material changes are made that significantly affect your privacy rights or the manner in which 98kr processes your personal data, 98kr will notify registered users via email to their registered email address and/or by posting a prominent notice on the Platform homepage at least 14 days before the changes take effect.

Your continued use of the 98kr Platform following the publication of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated Policy, your sole remedy is to cease using the Platform and, if desired, close your account in accordance with the Terms & Conditions.

If you have any questions, concerns, or complaints about this Privacy Policy or the way 98kr handles your personal data, please contact us at:

98kr takes all data protection concerns seriously and will investigate every complaint thoroughly. If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in 98kr's licensing jurisdiction or, where applicable, the data protection authority in your own country of residence.