But PKR Privacy Policy — How We Handle Your Information

But pkr (operated at butpkr.bet) is an online gaming platform serving players in Pakistan. This Privacy Policy explains how but pkr collects, uses, stores and protects the personal data of all users — registered account holders as well as visitors who browse the platform without registering.

When we say "personal data", we mean any information that can identify you as an individual — directly or in combination with other data. This includes your name, mobile number, CNIC details, IP address and transaction history, among other things described in this policy.

By using the but pkr platform — whether to browse, register, deposit or play — you confirm that you have read and understood this Privacy Policy. If you disagree with how we handle personal data, you should not use the platform. Questions about this policy can be directed to our support team at any time.

But pkr collects only the data that is necessary for the purposes described in Section 3. The categories of personal data we collect are:

Every piece of data but pkr holds about you exists for a specific, documented reason. We do not collect data speculatively or "just in case". The primary purposes for which we process personal data are:

• Account creation and management: To register your account, verify your identity, maintain your balance and provide access to the platform.
• Payment processing: To process deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card channels — and to comply with anti-money-laundering obligations.
• Game delivery: To run game sessions, record outcomes and resolve disputes about results.
• Legal compliance: To meet obligations under applicable Pakistani financial regulation, including identity verification and transaction record-keeping requirements.
• Fraud prevention: To detect and prevent fraudulent account activity, bonus abuse, collusion and money laundering attempts.
• Customer support: To respond to your queries, resolve complaints and improve our service based on your feedback.
• Responsible gaming: To monitor for signs of problem gambling behaviour and enforce self-exclusion, deposit limit and session limit settings that you activate.
• Platform improvement: To analyse usage patterns and improve the but pkr experience — anonymised and aggregated, never at the individual level.

But pkr processes your personal data under one or more of the following legal bases for each processing activity:

• Contract performance: Processing necessary to deliver the services you signed up for — account management, payments, game delivery.
• Legal obligation: Processing required by applicable Pakistani law — identity verification, financial record retention, anti-money-laundering checks.
• Legitimate interests: Processing in but pkr's legitimate business interest where it does not override your rights — fraud prevention, platform security, platform improvement using anonymised data.
• Consent: Where we rely on your consent — for example, optional marketing communications — you may withdraw that consent at any time by contacting our support team.

Your personal data is stored on secure servers with access controls that limit who can view it. Technical and organisational measures are in place to protect against unauthorised access, accidental loss, destruction or disclosure.

But pkr primarily stores data on servers located in or serving Pakistan. Where data processing involves a third-party service provider operating outside Pakistan — for example, a cloud infrastructure partner — but pkr ensures that appropriate data protection agreements are in place before any data transfer occurs.

Data at rest is encrypted using AES-256. Data in transit is protected using TLS 1.3. Internal access to personal data is role-restricted: only staff with a genuine operational need can access identifiable player data, and all such access is logged and audited.

But pkr does not sell your data. We do not share it with advertisers. We share personal data with third parties only in the following, limited circumstances:

• Payment providers: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT processors and card networks receive the minimum financial data necessary to complete your transaction. These providers operate under their own privacy policies and regulatory obligations.
• KYC and identity verification services: Where enhanced identity verification is required, a regulated KYC service provider may receive a copy of your identity document. This happens only where necessary and under a formal data processing agreement.
• Fraud prevention partners: Anonymised or pseudonymised data may be shared with fraud detection services to identify patterns of abuse across the industry. No identifiable personal data is shared in this context.
• Legal and regulatory authorities: But pkr will disclose personal data to government, regulatory or law enforcement authorities when legally required to do so — for example, under a valid court order or regulatory directive. We notify affected users where law permits us to do so.
• Platform infrastructure providers: Cloud hosting, database and security service providers may have access to server-level data as part of their service. All such providers are bound by confidentiality and data protection obligations before being engaged.

No data sharing arrangement at but pkr permits a third party to use your personal data for their own marketing or commercial purposes.

But pkr uses cookies and similar tracking technologies to keep your session active, remember your preferences and understand how players use the platform. The types of cookies we use are:

You can control non-essential cookies through your browser settings. Disabling essential cookies will affect platform functionality — specifically, you will not be able to remain logged in. But pkr does not use third-party advertising cookies or cross-site tracking technologies.

Handling financial data responsibly is especially important at but pkr because all transactions involve real Pakistani Rupees. Here is specifically how we treat payment-related personal data:

• Full payment card numbers are never stored on but pkr systems. Card transactions are processed via a PCI-DSS compliant payment gateway that handles card data entirely on their end. But pkr receives only a tokenised reference and the last four digits of the card.
• Mobile wallet identifiers (Easypaisa and JazzCash account numbers) are stored in encrypted form and used solely for processing your deposits and withdrawals. They are not accessible to but pkr staff outside of a formal dispute resolution process.
• Transaction records — amounts, timestamps, payment methods used — are retained for a minimum of five years to comply with Pakistani financial regulations. These records are used for dispute resolution and regulatory reporting only.
• Source-of-funds documentation, where requested, is handled by our compliance team under strict access controls and is retained only for as long as regulatory requirements demand.

But pkr does not keep personal data beyond the period necessary for the purpose it was collected. The retention schedule we follow is:

• Account data (name, contact details, identity documents): Retained for the duration of your account plus 5 years after closure, to meet financial regulatory requirements.
• Transaction records (deposit, bet and withdrawal history): Retained for 5 years from the date of each transaction in compliance with applicable Pakistani financial law.
• Support communications (chat transcripts, email): Retained for 2 years from the date of the last interaction, to resolve any follow-up disputes.
• Technical and usage data (IP logs, session data): Retained for 90 days and then automatically deleted, unless a specific security investigation requires their preservation.
• KYC documents: Retained for 5 years from account closure, as required by applicable anti-money-laundering obligations.

When retention periods expire, data is permanently deleted or irreversibly anonymised on a scheduled basis. But pkr does not archive personal data beyond these defined periods.

As a but pkr player based in Pakistan, you have the following rights with respect to the personal data we hold about you. These rights are not conditional and can be exercised at any time by contacting our support team:

To exercise any of these rights, contact our support team via live chat or email at support@butpkr.bet. We will respond within 7 business days. We may need to verify your identity before processing certain requests.

Protecting your personal data is a technical priority at but pkr, not just a policy commitment. The security measures we maintain include:

• Encryption in transit: All communications between your device and but pkr use TLS 1.3 with forward secrecy. Older, weaker protocols are disabled.
• Encryption at rest: Sensitive personal data fields (identity numbers, payment identifiers) are encrypted using AES-256 in our database layer.
• Access controls: Personal data is accessible only to staff with a documented operational need. Access is role-based, logged and reviewed quarterly.
• Two-factor authentication: All internal but pkr staff accounts with access to player data require two-factor authentication. Players are strongly encouraged to enable 2FA on their own accounts.
• Penetration testing: But pkr undergoes periodic security penetration testing by independent third parties to identify and remediate vulnerabilities.
• Incident response: A documented data breach response plan is in place. In the event of a breach affecting your personal data, but pkr will notify affected players within 72 hours of discovery where required by applicable law.

But pkr is strictly for users aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe a minor has registered an account or provided personal data on the but pkr platform, please contact our support team immediately at support@butpkr.bet.

Upon verified notification that personal data belonging to a minor has been collected, but pkr will delete that data without delay and close the associated account. Any funds deposited by a minor will be returned to the payment source after verification of the situation.

But pkr may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law or improvements to our platform. When a material update is made, we will:

• Update the "Effective Date" shown at the top of this page.
• Notify registered players by in-app notification and, where the change is significant, by email to the address on file.
• Provide at least 7 days' notice before the updated policy takes effect, so you have time to review the changes.

Continued use of the but pkr platform after the updated policy's effective date constitutes your acknowledgement of the changes. If you disagree with a material change, you should close your account before the new policy takes effect. Previous versions of this policy are available on request.

If you have any question about how but pkr handles your personal data, want to exercise one of your rights or need to report a potential data security issue, you can reach us through these channels:

• Email: support@butpkr.bet — use subject line "Privacy Request" for faster routing to the right team.
• Live Chat: Available 24/7 within your but pkr account dashboard. Fastest response for urgent queries.
• Response Time: Privacy-related requests are acknowledged within 24 hours and substantively responded to within 7 business days.

For questions about our Terms and Conditions, visit our Terms and Conditions page. For responsible gaming tools and support, visit our Responsible Gaming page. For general questions, visit our FAQ page.