Privacy Policy – Bad PKR Data Protection & Your Rights

This Privacy Policy is issued by Bad PKR ("Bad PKR", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at badpkr.ws. Bad PKR is the data controller responsible for your personal information collected through registration, use of the platform, and all related interactions.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This policy applies to all registered players, visitors to the Bad PKR website, and anyone who contacts our support team.

If you have any questions about this policy or about how Bad PKR handles your personal data, please contact us at privacy@badpkr.ws. We aim to respond to all privacy enquiries within 5 business days.

Bad PKR collects personal data through several channels: the registration process, ongoing platform use, payment transactions, support interactions, and device/browser technical data. Below is a straightforward breakdown of each category.

Registration & Identity Data

When you create a Bad PKR account, we collect the information you provide during registration, including:

• Full legal name
• Date of birth (for age verification purposes)
• Email address
• Mobile phone number
• Residential address in Pakistan
• CNIC or passport number (collected during identity verification)
• Username and encrypted password

Payment & Financial Data

To process deposits and withdrawals in PKR, Bad PKR collects payment-related information, including:

• Easypaisa, JazzCash, NayaPay, or SadaPay mobile wallet numbers
• Bank account details (IBAN and bank name) for IBFT transfers
• Partial card details (first six and last four digits, expiry date) for Visa/Mastercard transactions — full card numbers are handled exclusively by our PCI-DSS compliant payment processors and are never stored by Bad PKR itself
• Transaction history (deposits, withdrawals, amounts, dates)

Identity Verification (KYC) Documents

As part of our anti-money laundering obligations, we may collect and securely store copies of:

• Government-issued photo identification (CNIC, passport, driving licence)
• Proof of address documents (utility bills, bank statements)
• Source of funds declarations for large transactions

Platform Usage Data

When you use Bad PKR, we automatically collect data about your activity on the platform, including:

• Games played, bets placed, stakes, and outcomes
• Session start and end times, session duration
• Pages and sections visited within the Bad PKR platform
• Promotions viewed and claimed
• Responsible gaming tool settings you have configured

Technical & Device Data

• IP address and approximate geographic location (country and city level)
• Device type, operating system, and browser version
• Unique device identifiers
• Connection type (WiFi, 4G, 5G)
• Cookie and tracking data (see Section 6)

Communications Data

When you contact Bad PKR support or otherwise communicate with us, we collect and retain records of those communications, including the content of live chat transcripts, support emails, and any documents you share with us during the interaction.

Bad PKR uses your personal data only for purposes that are necessary, legitimate, and proportionate. The table below summarises each primary use and the data categories involved.

Bad PKR does not use your personal data for purposes beyond those listed above. We do not use your data for profiling that produces automated decisions with significant legal effects — for example, your individual gaming history is not used to automatically deny a withdrawal without human review.

Bad PKR relies on the following legal bases for processing your personal data:

• Contractual necessity: Processing required to fulfil our contract with you — i.e., to operate your account, process your bets, pay your winnings, and provide platform access. Without this processing, we cannot provide the Bad PKR service.
• Legal obligation: Processing required to comply with applicable law, including age verification, anti-money laundering checks, fraud monitoring, and record-keeping obligations.
• Legitimate interests: Processing where Bad PKR has a legitimate business interest that does not override your fundamental privacy rights — for example, fraud detection, security monitoring, and platform improvement through aggregated usage analytics.
• Consent: Where we rely on your consent — specifically for marketing communications — we will ask for your explicit agreement. You can withdraw that consent at any time without affecting your account.

Bad PKR does not sell, rent, or trade your personal data. We share data only where it is necessary to deliver our service, comply with legal obligations, or protect against fraud. The following categories of recipients may receive your personal data:

Payment Processors

Your payment details are shared with the payment service providers that process your PKR transactions — including the backend operators of Easypaisa, JazzCash, NayaPay, SadaPay, and IBFT banking networks, as well as Visa/Mastercard processing partners. These providers are bound by strict data processing agreements and handle payment data under their own regulatory frameworks.

Identity Verification Services

For KYC purposes, Bad PKR works with identity verification providers who process your CNIC, passport images, and other verification documents. These providers are contractually bound to use your data only for the purpose of completing the verification check for Bad PKR and for no other purpose.

Game Software Providers

Some technical data (such as session identifiers and game transaction records) is shared with the licensed game studios that supply the slot, live dealer, and virtual sports titles in the Bad PKR lobby. This is technically necessary for the games to function correctly and for jackpot pools to operate across shared networks where applicable.

Regulatory & Law Enforcement Authorities

Bad PKR may disclose your personal data to Pakistani law enforcement agencies, financial intelligence authorities, or other regulatory bodies where we are legally required or permitted to do so — for example, in response to a valid court order, as part of an anti-money laundering investigation, or to report suspected financial crime.

Service Providers

We engage third-party service providers for functions such as cloud hosting, email delivery, live chat software, and analytics. These providers act as data processors under contractual agreements that prohibit them from using your data for any purpose other than the specific service they provide to Bad PKR.

Bad PKR uses cookies and similar tracking technologies on badpkr.ws. A cookie is a small text file stored on your device by your browser. We use the following categories of cookies:

• Essential cookies: Required for the platform to function. These maintain your login session, remember your preferences, and enable secure transactions. You cannot opt out of essential cookies while using Bad PKR, as they are necessary for the service to operate.
• Analytics cookies: These help Bad PKR understand how players use the platform — which games are most popular, where players spend time, and which flows cause friction. Data collected is aggregated and does not identify you individually. You may opt out of analytics cookies via the cookie settings panel accessible from the site footer.
• Functional cookies: These remember choices you make (such as language preferences or responsible gaming display settings) to improve your experience. They are not strictly essential but improve usability.
• Security cookies: Used for fraud detection and login security purposes, such as identifying unusual login patterns or suspicious device changes.

By using Bad PKR, you consent to the use of essential and security cookies. For analytics and functional cookies, you can manage your preferences at any time. Note that blocking all cookies will impair your ability to use Bad PKR and may prevent login.

Bad PKR retains personal data for no longer than is necessary for the purposes for which it was collected, subject to our legal obligations to retain certain records for specified periods. The following retention periods apply:

• Account data and transaction records: Retained for a minimum of 5 years after account closure. This is required for anti-money laundering compliance and financial record-keeping obligations.
• KYC documents (CNIC copies, proof of address): Retained for 5 years after account closure or the last transaction, whichever is later.
• Support communications: Retained for 3 years after the interaction, to enable resolution of any subsequent disputes referencing the same issue.
• Marketing consent records: Retained for 3 years after your last interaction with Bad PKR marketing communications, as evidence of your consent or opt-out.
• Analytics data: Aggregated analytics data is retained indefinitely; session-level data linked to individual accounts is anonymised within 13 months.
• Fraud investigation records: Retained for up to 7 years where a fraud investigation was initiated, to support any subsequent legal proceedings.

When a retention period expires, Bad PKR will securely delete or anonymise the relevant data. Secure deletion means the data cannot be recovered or reconstructed from storage.

Bad PKR takes data security seriously and has implemented a layered set of technical and organisational measures to protect your personal information:

• TLS 1.3 encryption in transit: All data exchanged between your browser or mobile device and the Bad PKR servers is encrypted using TLS 1.3. This means that even if network traffic were intercepted, the content would be unreadable.
• Encryption at rest: Sensitive personal data stored in Bad PKR's databases — including CNIC numbers, payment details references, and KYC document data — is encrypted at rest using AES-256.
• Access controls: Personal data is accessible only to Bad PKR staff and contractors who need it to perform their specific functions. All access is logged, and unnecessary access is denied by default.
• Password hashing: Bad PKR passwords are stored as salted cryptographic hashes. No one at Bad PKR can see your plaintext password — not support staff, not system administrators.
• Two-factor authentication (2FA): Bad PKR supports and encourages 2FA on player accounts for additional login security.
• PCI-DSS compliant payment handling: Full card numbers are processed exclusively by our PCI-DSS certified payment processing partners and are never stored on Bad PKR's own servers.
• Regular security testing: Bad PKR conducts periodic security assessments including penetration testing of the platform's external-facing systems.
• Incident response: Bad PKR maintains a data breach response procedure. In the event of a security incident that puts your personal data at risk, we will notify affected players and relevant authorities within the timeframes required by applicable law.

You have the following rights regarding your personal data held by Bad PKR. To exercise any of these rights, contact us at privacy@badpkr.ws. We will respond within 5 business days and complete most requests within 30 days.

Bad PKR is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we discover that a minor has created an account or provided personal data to Bad PKR, we will immediately close the account, delete all associated personal data, and reverse any deposits made. Any winnings accumulated by an underage account will be forfeited.

If you are a parent or guardian and believe your child has created an account on Bad PKR, please contact us immediately at privacy@badpkr.ws or via live chat. We treat underage gambling reports with the highest priority.

Bad PKR may send you promotional communications about bonuses, new games, PSL betting offers, and other platform news. We will only send these if you have explicitly opted in during registration or at a later point. We do not send unsolicited marketing communications.

You can opt out of marketing communications from Bad PKR at any time by:

• Clicking the "Unsubscribe" link in any marketing email from Bad PKR
• Updating your communication preferences in the Notifications section of your account settings
• Contacting support at support@badpkr.ws and requesting removal from marketing lists

Opting out of marketing does not affect transactional communications — you will still receive account-related notifications such as deposit confirmations, withdrawal updates, security alerts, and important policy change notifications. These are necessary for the operation of your account and cannot be turned off while your account is active.

Bad PKR uses email and SMS as marketing channels. We do not conduct telephone marketing calls. We do not share your contact details with any third-party marketers.

Bad PKR may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Send a notification email to your registered address
• Display a notice on the Bad PKR platform when you next log in

Minor clarifications or administrative changes (such as correcting a typo or updating a contact address) may be made without specific notification. We recommend reviewing this page periodically regardless.

Your continued use of Bad PKR after a privacy policy update is notified constitutes your acknowledgement of the updated policy. If you object to any change, you should stop using the platform and may request account closure.

If you have any questions, concerns, or complaints about how Bad PKR handles your personal data, we want to hear from you. Please contact us using one of the following methods:

• Privacy enquiries: privacy@badpkr.ws
• General support (including data rights requests): support@badpkr.ws
• Live chat: Available 24/7 via the chat widget on badpkr.ws

For formal data rights requests (Subject Access Requests, erasure requests, rectification requests), please use the email address privacy@badpkr.ws with the subject line "Data Rights Request" to ensure your request is routed directly to the appropriate team.

Bad PKR aims to resolve all privacy-related enquiries within 5 business days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority.