92koko Privacy
Policy

1. Introduction

This Privacy Policy describes how 92koko ("we", "us", "our"), the operator of the online gaming platform accessible at 92koko.org, collects, processes, stores, and protects the personal data of users ("you", "your") who access or register on the 92koko platform.

This Policy applies to all personal data collected through the 92koko website, mobile web application, customer support interactions, and any other service provided by 92koko. It should be read alongside the Terms & Conditions and Responsible Gaming Policy, which together form the complete regulatory framework governing your use of the 92koko platform.

By registering an account on 92koko, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you must not create an account or use the 92koko platform.

2. Data Controller

For the purposes of data protection law, 92koko is the data controller responsible for your personal data. As data controller, 92koko determines the purposes and means by which your personal data is processed.

All data protection enquiries, access requests, deletion requests, and formal complaints regarding the processing of personal data should be directed to the 92koko data protection contact via the channels described in Section 14 of this Policy.

3. Personal Data We Collect

92koko collects only the personal data that is necessary for the provision of the gaming platform, compliance with legal and regulatory obligations, and the improvement of the user experience. The categories of personal data we collect are set out in the table below.

4. How We Collect Personal Data

92koko collects personal data through the following channels:

• Direct submission: Information you provide during registration, KYC verification, cashier transactions, support interactions, or when completing your profile.
• Automated collection: Technical and gaming data collected automatically when you access or use the 92koko platform, including through cookies and session tracking technologies.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other integrated payment providers when you make deposits or withdrawals.
• Identity verification services: Data returned from third-party KYC service providers used to verify the identity and age of 92koko account holders.
• Fraud prevention services: Risk assessment data provided by third-party fraud detection and anti-money laundering screening services.

5. Purpose & Legal Basis for Processing

92koko processes personal data only where there is a lawful basis to do so. The following table sets out the primary purposes for which 92koko processes personal data and the corresponding legal basis for each.

6. Data Sharing & Third Parties

92koko does not sell, rent, or trade your personal data to third-party marketing organisations. However, in order to operate the platform and comply with legal obligations, 92koko may share limited personal data with the following categories of trusted third parties:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast — solely for the purpose of processing your deposits and withdrawals in PKR.
• KYC and identity verification providers: Third-party services used to verify the identity and age of account holders, as required for regulatory compliance.
• Fraud prevention and AML screening services: Services used to detect suspicious transactions, prevent money laundering, and protect the platform from fraud.
• Game content providers: Licensed game developers (such as Pragmatic Play, Evolution Gaming, and PG Soft) who may receive anonymised session data required for game functionality and RNG certification.
• IT and hosting infrastructure providers: Cloud hosting and server management providers who store and process data on behalf of 92koko under strict data processing agreements.
• Regulatory and law enforcement authorities: Where 92koko is legally required to disclose personal data in response to lawful requests from competent authorities.

All third parties who process personal data on behalf of 92koko are required to enter into appropriate data processing agreements and are bound to handle your data only in accordance with 92koko's instructions and applicable data protection standards.

7. International Data Transfers

The operation of the 92koko platform may involve the transfer of personal data to countries outside Pakistan, including to server infrastructure or service providers located in other jurisdictions. Where such transfers occur, 92koko ensures that appropriate safeguards are in place to protect your data, including contractual data protection clauses, standard contractual clauses, or equivalent data transfer mechanisms recognised under applicable law.

By using the 92koko platform, you acknowledge and consent to the transfer of your personal data to other countries where necessary for the provision of 92koko's services, subject to the safeguards described in this section.

8. Data Retention

92koko retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, as required by anti-money laundering regulations.
• Transaction and gaming records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC documentation: Retained for the duration of the account relationship and for a minimum of 5 years following account closure.
• Customer support communications: Retained for 2 years from the date of the last interaction, unless a formal complaint or legal proceeding requires longer retention.
• Marketing preference records: Retained for the duration of the account relationship and for 1 year following any opt-out request, to maintain a suppression record.
• Technical and session logs: Retained for 12 months from the date of generation, for security monitoring and fraud prevention purposes.

Where personal data is no longer required for any lawful purpose, 92koko will securely delete or anonymise it in accordance with established data disposal procedures.

9. Data Security

92koko implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 92koko platform
• AES-256 encryption for personal data stored in 92koko's systems
• Bcrypt hashing of all account passwords — passwords are never stored in recoverable form
• OTP-based two-factor verification for login and high-value withdrawals
• Role-based access controls ensuring that internal staff access only the data necessary for their specific function
• Regular security audits and penetration testing of the 92koko platform infrastructure
• Continuous monitoring for suspicious login activity and automated account locking on anomalous access attempts
• Physical and logical access controls for all server and infrastructure environments

10. Your Data Protection Rights

As a 92koko user, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact our support team via live chat or at the email address listed in Section 14.

92koko will not charge a fee for responding to a data rights request unless the request is manifestly unfounded or excessive. Where a fee applies, you will be notified before your request is processed. 92koko may request proof of identity before fulfilling any data rights request.

11. Cookies & Tracking Technologies

The 92koko platform uses cookies and similar tracking technologies to maintain session state, remember user preferences, prevent fraud, and analyse platform performance. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the 92koko platform, including session authentication, security tokens, and load balancing. These cookies cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your language preferences, game settings, and other personalisation choices. These improve your experience but are not essential to platform operation.
• Analytics cookies: Used to collect anonymised data about how users interact with the 92koko platform, enabling us to improve navigation, identify technical issues, and optimise performance.
• Security cookies: Used to detect and prevent fraudulent login attempts, session hijacking, and other security threats.

92koko does not use third-party advertising cookies or cross-site tracking technologies for commercial advertising purposes. You can manage cookie preferences through your browser settings, though disabling strictly necessary cookies may prevent you from using certain features of the 92koko platform.

12. Minors & Age Restriction

The 92koko platform is strictly restricted to individuals who are 21 years of age or older. 92koko does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

Parents and guardians who believe that a minor under their care has created a 92koko account or submitted personal data to the platform are urged to contact our support team immediately so that appropriate action can be taken without delay.

13. Changes to This Privacy Policy

92koko reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, business practices, or the features of the 92koko platform. Material changes to this Policy will be communicated to registered users via their registered email address or through an in-platform notification, at least 7 days before the changes take effect.

The "Last Updated" date at the top of this document reflects the date of the most recent revision. Your continued use of the 92koko platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us — Data Protection Enquiries

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need to report a potential data protection concern, please contact the 92koko data protection team through the following channels:

• Live Chat: Available 24/7 directly from the 92koko platform — the fastest route for urgent data concerns
• Email: [email protected] — please include "Privacy Request" in the subject line
• FAQ: 92koko.org/faq — answers to common questions about account data and settings

92koko aims to acknowledge all data protection requests within 72 hours and to provide a substantive response within 30 calendar days of receiving a valid, verified request. Complex requests may take longer, in which case you will be notified of the extended timeline.