clupk Privacy Policy — How We Protect Your Data

This Privacy Policy is published by clupk, the operator of the website clupk.app ("the Platform"). clupk acts as the Data Controller in respect of all personal data collected from players and visitors through the Platform. As Data Controller, clupk determines the purposes for which and the means by which personal data is processed.

clupk is licensed and regulated by an international gaming licensing authority. Our licensing framework includes data protection obligations that govern how we collect, process, store, and share the personal data of our players, including Pakistani players accessing clupk from Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan.

For all privacy-related queries, data access requests, or complaints, please contact us at [email protected], clearly marking your communication "Privacy Request."

clupk collects personal data across several categories, depending on how you interact with the Platform. The following table summarises the categories of personal data collected, the specific data points within each category, and the primary purpose for which they are collected:

clupk does not collect or process special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) except where strictly necessary to comply with a legal obligation and with explicit consent where required.

clupk collects personal data through the following channels:

• Direct Provision: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically through your interaction with the Platform, including through cookies, web beacons, and server logs. See Section 07 for detailed cookie information.
• Payment Providers: Confirmation data received from JazzCash, EasyPaisa, Raast, and banking partners when you make a deposit or withdrawal — including transaction reference numbers and confirmation statuses.
• Third-Party Identity Verification Services: Where clupk uses third-party KYC verification services to validate your identity documents, those providers may return verification results and flagged data points to clupk.
• Fraud Prevention Partners: Data received from fraud detection and AML compliance services that clupk uses to verify the legitimacy of accounts and transactions.
• Game Providers: Game round data, RNG outcomes, and session information generated by third-party game providers whose games are integrated into the clupk Platform.

clupk processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing necessary to fulfil our obligations to you under the Terms and Conditions of the Platform — including account management, game provision, payment processing, and customer support.
• Legal Obligation: Processing required to comply with our obligations under the international gaming license framework, including KYC verification, AML compliance, age verification, and record-keeping obligations.
• Legitimate Interests: Processing carried out for clupk's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, product improvement, and service analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out with your explicit consent, including the delivery of marketing communications and personalised promotional offers. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

clupk uses the personal data it collects for the following purposes:

Service Delivery

• Creating and managing your clupk Account, including authentication and session management.
• Processing deposits, withdrawals, and Wallet transactions in Pakistani Rupees.
• Enabling access to casino games, sports betting markets, crash games, and all other Platform features.
• Delivering customer support through live chat, email, and other channels.

Legal and Regulatory Compliance

• Verifying your identity and age as required by our gaming license (KYC).
• Monitoring transactions for Anti-Money Laundering (AML) compliance and reporting suspicious activity to relevant authorities where legally required.
• Maintaining records of all transactions and account activities as required by licensing regulations.
• Enforcing responsible gaming measures, including monitoring for signs of problem gambling and applying requested or mandatory self-exclusion measures.

Security and Fraud Prevention

• Detecting and preventing fraudulent account registrations, bonus abuse, multi-accounting, and unauthorised access.
• Monitoring login activity for anomalies and triggering security challenges when unusual behaviour is detected.
• Sharing data with fraud prevention partners where a serious risk of fraud or financial crime is identified.

Platform Improvement and Analytics

• Analysing aggregate usage patterns to improve Platform design, game selection, and the overall user experience for Pakistani players.
• Conducting internal performance analysis and reporting, including assessment of responsible gaming tool effectiveness.

Marketing Communications (Consent Only)

• Sending promotional offers, bonus announcements, PSL season specials, and platform news to Players who have opted in to receive marketing communications.
• Personalising promotional content based on your gaming preferences and history, where consent has been provided.

clupk does not sell, rent, or trade your personal data. We share your personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK receive transactional data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are bound by their respective regulatory frameworks.
• KYC and Identity Verification Providers: Third-party identity verification services receive your identity documents and personal data for the sole purpose of verifying your identity and age as required by our gaming license.
• Game Providers: Third-party game studios and live casino operators whose games are hosted on the clupk Platform receive technical session data and game round information necessary to deliver their games. They do not receive your financial or identity data beyond what is required for game function.
• Fraud Prevention and AML Partners: Specialist fraud prevention and AML compliance services receive data necessary to identify potential financial crime or platform abuse. All such partners are contractually bound to data protection standards equivalent to those applied by clupk.
• Regulatory and Legal Authorities: clupk will disclose personal data to regulatory authorities, law enforcement agencies, courts, or other public bodies where required to do so by law, court order, or as part of our compliance with our international gaming license obligations.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of clupk's business, your personal data may be transferred to the acquiring entity, subject to that entity providing equivalent or greater data protection standards.

clupk uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device when you visit the Platform. They serve a number of important functions that enable the Platform to work correctly and securely.

Types of Cookies Used by clupk

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your preferences — such as language settings, responsible gaming limit settings, and display preferences — so you don't need to re-enter them on every visit.
• Analytics Cookies: Collect anonymised information about how players interact with the Platform, which pages are most visited, and how long sessions last. This data is used in aggregate to improve Platform design and performance.
• Security Cookies: Support clupk's fraud detection and account security systems by maintaining session integrity and identifying anomalous access patterns.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect some functionality such as personalised content and preference retention. Please note that strictly necessary cookies cannot be disabled through browser settings without preventing access to the Platform entirely.

clupk does not use third-party advertising cookies or tracking pixels that share your data with external advertising networks.

clupk retains your personal data for only as long as is necessary for the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your Account and for a minimum of five years following Account closure, as required by AML and gaming license record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of seven years from the date of each transaction, in compliance with financial regulation requirements.
• KYC Documents: Retained for five years after the end of the business relationship, as required by AML regulations applicable under our gaming license.
• Customer Support Communications: Retained for three years from the date of the interaction, unless the communication relates to a dispute or legal matter, in which case it will be retained until the matter is fully resolved.
• Technical and Usage Data: Retained for up to 24 months in identifiable form, after which it is anonymised or deleted.
• Marketing Consent Records: Retained for the duration of your consent and for one year following withdrawal of consent, as evidence of consent management compliance.

When personal data is no longer required and the applicable retention period has expired, clupk will securely delete or anonymise the data. Anonymised data that cannot be re-identified may be retained indefinitely for analytical purposes.

clupk implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and clupk's servers.
• AES-256 encryption for all sensitive personal data stored on clupk's systems.
• Multi-factor authentication requirements for all administrative access to systems containing personal data.
• Role-based access controls limiting access to personal data to clupk personnel who require it for their specific duties.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Automated anomaly detection on Platform access logs to identify and respond to potential security incidents.
• Regular staff training on data protection obligations and security practices.

As a player on the clupk Platform, you have the following rights in respect of your personal data. These rights are subject to certain limitations and exemptions under applicable law:

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request." clupk will respond within 30 days. We may request proof of identity before processing your request to ensure we are responding to the correct individual.

Where clupk declines to fulfil a request, we will provide written reasons and information about your right to escalate the matter to our licensing authority or the relevant data protection supervisory authority.

clupk's operations, infrastructure, and some of its third-party service providers are located outside of Pakistan. As a result, your personal data may be transferred to and processed in countries other than Pakistan. clupk takes steps to ensure that any such international transfer of personal data is carried out with appropriate safeguards in place, including:

• Requiring all recipient entities to implement data protection standards equivalent to those required under our gaming license framework.
• Using standard contractual clauses or equivalent data transfer mechanisms with all processors located outside of Pakistan.
• Conducting due diligence on the data protection practices of all third-party service providers before engaging them.

By using the clupk Platform, you acknowledge that your personal data may be transferred to and processed in countries outside of Pakistan in accordance with the safeguards described above.

If clupk discovers that personal data has been provided by a person under the age of 21, all data associated with that account will be immediately and permanently deleted, and the account will be closed with all associated funds returned to the payment method used for deposit. If you believe a minor has created an account on clupk, please contact us immediately at [email protected].

Parents and guardians in Pakistan concerned about online gambling access are encouraged to use parental control tools available through Pakistani mobile operators and internet service providers to restrict access to gambling platforms for minors in their households.

The clupk Platform does not contain links to external third-party websites as a general rule. Where any reference to a third-party service or resource is made, please be aware that clupk has no control over the privacy practices of third-party websites and is not responsible for the content or privacy policies of any external site.

Game providers whose games are integrated into the clupk Platform may collect technical game data through their own systems. The privacy practices of individual game providers are governed by those providers' own privacy policies, which are independent of this Policy. clupk requires all integrated game providers to meet minimum data protection standards as a condition of their integration onto the Platform.

clupk may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes to applicable law, or changes to our licensing obligations. Material changes to this Policy will be communicated to registered Players via their registered email address no less than 14 days before the change takes effect.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. The current version of this Privacy Policy is always accessible at clupk.app/privacy-policy. Continued use of the Platform following notification of changes to this Policy constitutes your acknowledgement of the updated Policy.

If you do not agree with any material change to this Privacy Policy, you should close your Account before the updated Policy takes effect. Account closure will not affect the lawfulness of processing carried out under the previous version of the Policy.

All privacy-related communications, data subject access requests, objections, and complaints should be directed to clupk using the details below. clupk is committed to resolving all privacy-related concerns promptly and transparently.

• Email: [email protected] — subject line: "Privacy Request" or "Data Rights Request"
• Live Chat: Available 24/7 from within your clupk Account for urgent privacy concerns or to report a suspected security incident.
• Response Time: clupk acknowledges all privacy requests within 48 hours and provides a substantive response within 30 calendar days. Complex requests may require up to 60 days, in which case we will notify you of the extension.

If you are not satisfied with clupk's response to a privacy concern, you have the right to escalate the matter to the data protection supervisory authority or complaint body designated by clupk's international gaming licensing jurisdiction. Contact details for the relevant authority will be provided in our written response to your complaint.

clupk values every privacy concern raised by Pakistani players and treats all privacy communications with the seriousness and confidentiality they deserve. Our commitment to your privacy is not limited to compliance — it is a foundational part of what it means to be a trustworthy platform operating in Pakistan.