Privacy Policy

1 Introduction

culpk ("we", "us", "our" or "the Platform") is an English-language online gambling information and platform portal accessible at https://culpk.cam/, designed for users in Pakistan and other permitted jurisdictions. We understand that your personal data is important to you. This Privacy Policy sets out in clear, structured terms exactly what data we collect, why we collect it, how we use it and what rights you have in relation to it.

This Policy applies to all personal data processed in connection with your use of the Platform, including account registration, identity verification (KYC), deposits, wagering, withdrawals, customer support interactions and any other activity conducted through culpk.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, please do not use the Platform.

2 Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, email address, CNIC number, IP address and financial data.
• "Processing" — Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, alteration or deletion.
• "Controller" — The entity that determines the purposes and means of processing your Personal Data; in this context, culpk and/or the Operator.
• "Processor" — A third party that processes Personal Data on behalf of the Controller under contractual obligation.
• "Consent" — A freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" — Identity and address verification documents, including CNIC, passport, proof of address and liveness or selfie verification images.
• "Cookies" — Small text files placed on your device by the Platform to support session management, user preferences and analytics functions.
• "Operator" — The licensed gaming entity that operates the wagering functionality and processes financial transactions on the Platform.

3 Data We Collect

We collect different categories of Personal Data depending on how you interact with the Platform. The table below summarises the main categories and examples of each:

We do not knowingly collect special-category sensitive data (such as health, biometric or political opinion data) except where a liveness or selfie check is required for KYC purposes as part of age and identity verification. Such data is used only for verification and is not retained beyond the period required for that purpose.

4 How We Collect Data

Your Personal Data is collected through the following mechanisms:

• Directly from you: when you register an account, complete KYC, make a deposit or withdrawal, contact support or respond to communications from us.
• Automatically: through cookies, server logs, analytics tools and similar technologies when you access and navigate the Platform.
• From third-party identity verification providers: when KYC checks are conducted using document verification or liveness services operating under contractual data processing agreements.
• From payment service providers: transaction data is shared between your payment provider (such as your bank or mobile wallet) and the Operator to confirm and reconcile deposits and withdrawals.
• From fraud prevention and AML screening services: data may be cross-referenced against sanctions lists or fraud databases as required by the Operator's compliance obligations.

5 Legal Basis for Processing

We process your Personal Data only where a valid legal basis exists under applicable data protection law in the Operator's licensing jurisdiction. The legal bases we rely on include:

• Contractual necessity: processing required to register your account, execute deposits and withdrawals, operate your wagers and provide customer support.
• Legal obligation: processing required to comply with KYC, AML, responsible gambling and regulatory reporting obligations imposed on the Operator under its licence.
• Legitimate interests: processing for fraud detection, platform security, abuse prevention and analytics used to improve the Platform — provided your rights and interests do not override these.
• Consent: where you have provided specific, informed consent — for example, for optional marketing communications. You may withdraw consent at any time by contacting support.

6 How We Use Your Data

Personal Data collected by culpk is used for the following purposes:

• To create and manage your account, including authentication and session management.
• To conduct identity verification (KYC) and age verification in compliance with the Operator's licence obligations.
• To process deposits, settle wagers, calculate winnings and execute withdrawal requests.
• To detect, investigate and prevent fraud, collusion, money laundering, multi-accounting and other prohibited conduct.
• To enforce responsible gambling obligations — including monitoring for problem gambling indicators and applying self-exclusion and deposit limit requests.
• To communicate with you regarding your account, including transaction confirmations, security alerts and policy updates.
• To provide customer support through Live Chat, Help Centre interactions and email correspondence.
• To conduct internal analytics to improve Platform performance, game availability and user experience.
• To send optional promotional communications where you have consented to receive them, subject to your right to opt out at any time.

7 Data Sharing & Disclosure

culpk does not sell your Personal Data to any third party. We may share your data with the following categories of recipients where it is necessary for the purposes described in this Policy:

• The Operator and its licensed gaming platform: to operate your account, process wagers and manage financial transactions.
• KYC and identity verification providers: to verify your identity, age and address as required by the Operator's licence.
• Payment processors: to process deposits and withdrawals. This includes data exchanged with banking networks and mobile wallet services where applicable. Payment provider names (e.g., Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah) are referenced as contextual Pakistani payment options only; their mention does not imply that they endorse or facilitate gambling transactions.
• Fraud prevention and AML screening services: to comply with anti-money laundering, sanctions screening and fraud detection obligations.
• IT infrastructure and security providers: hosting, database management and cybersecurity services operating under contractual data processing agreements.
• Regulatory and law enforcement authorities: where required to comply with a legal obligation, court order or lawful request from a competent authority in the Operator's licensing jurisdiction.

8 International Data Transfers

The Operator may process or store your Personal Data in jurisdictions outside Pakistan, including jurisdictions in which the Platform's gaming licence is registered and in which the Operator's technology infrastructure is hosted. Such transfers are conducted under the data protection framework applicable in the Operator's licensing jurisdiction.

Where data is transferred internationally, we ensure that appropriate contractual or legal safeguards are in place between culpk, the Operator and any relevant sub-processors to protect your data to a standard that is consistent with the protections described in this Policy.

If you have questions about the specific jurisdictions to which your data may be transferred, please contact us using the details in Section 16.

9 Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, regulatory or reporting requirements.

• Account data: retained for the duration of your active account and for a minimum period following account closure as required by the Operator's licence (typically 5–7 years, depending on jurisdiction).
• KYC documentation: retained for the period required by AML regulations in the Operator's licensing jurisdiction, typically a minimum of five years following the end of the business relationship.
• Transaction records: retained for regulatory reporting purposes for a minimum of five years following each transaction.
• Support communications: retained for a period sufficient to resolve disputes, typically up to three years following the last interaction.
• Marketing preferences: retained until you withdraw consent or request deletion, subject to overriding legal retention obligations.

When data is no longer required, it is securely deleted or anonymised in a manner that prevents re-identification.

10 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to support its operation. Cookies are small text files stored on your device when you visit the Platform. They do not contain executable code and cannot be used to access other data on your device.

The following categories of cookies are used on culpk:

• Strictly necessary cookies: essential for the Platform to function. They enable session management, authentication and security features. These cannot be disabled without rendering the Platform inoperable.
• Functional cookies: remember your preferences such as language settings, account display options and previously entered information to improve usability.
• Analytics cookies: collect aggregated, anonymised data about how users navigate the Platform to help us identify areas for improvement. No personally identifiable information is included in analytics reports.
• Performance cookies: monitor Platform speed, availability and error rates to support technical maintenance and reliability.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality or performance of the Platform.

11 Security Measures

culpk implements technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, loss or destruction. These measures include but are not limited to:

• HTTPS/TLS encryption: all data transmitted between your device and the Platform is encrypted using current TLS protocols. Never enter your credentials on a page that does not display a valid security certificate.
• Access controls: access to Personal Data is restricted to authorised personnel who require it for the fulfilment of their specific role. Access logs are maintained and reviewed.
• Secure document handling: KYC documents must be uploaded exclusively through the Platform's secure verification portal. Never send identity documents via email, social media or unencrypted messaging applications.
• Data minimisation: we collect only the data necessary for the stated purpose and do not retain data beyond the applicable retention period.
• Incident response: in the event of a data breach that poses a risk to your rights, we will notify affected users and, where required, the relevant supervisory authority within the timeframes required by applicable law.

12 Your Data Rights

Subject to applicable data protection law in the Operator's licensing jurisdiction, you may have the following rights in relation to your Personal Data:

• Right of Access: you may request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: you may request that inaccurate or incomplete Personal Data be corrected. For account details, you can update most information directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): you may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (such as AML and regulatory requirements).
• Right to Restriction: you may request that we temporarily suspend processing of your Personal Data in certain circumstances, for example while a dispute regarding accuracy is being resolved.
• Right to Data Portability: where processing is based on consent or contractual necessity and conducted by automated means, you may request that your data be provided in a structured, machine-readable format.
• Right to Object: you may object to processing based on legitimate interests, including any profiling conducted for fraud prevention or marketing purposes.
• Right to Withdraw Consent: where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact us using the details provided in Section 16. We will respond to verified requests within the timeframes required by applicable law, typically within 30 days. We may need to verify your identity before processing a data rights request.

13 Minors

The Platform is strictly intended for individuals aged 18 years or older — or the higher minimum age required by the Operator or the applicable licence jurisdiction. culpk does not knowingly collect Personal Data from individuals below the minimum eligible age.

Age verification is a mandatory part of the KYC process. If we discover that a minor has registered an account or provided Personal Data, we will immediately suspend the account, delete or restrict access to the relevant data, and return any deposits where required by law.

If you are a parent or guardian and believe that a minor has used the Platform or provided Personal Data without your knowledge, please contact us immediately using the details in Section 16.

14 Third-Party Links & Services

The Platform may contain references to or contextual mentions of third-party payment services (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) and sports contexts (such as PSL, ICC and Pakistan cricket). These are mentioned for contextual relevance to Pakistani users only.

culpk is not responsible for the privacy practices, data processing activities or content of any third-party platform, service or organisation. Where you interact directly with a third-party service — for example, a payment provider — that service's own privacy policy governs the processing of your data within their systems. We encourage you to review third-party privacy policies before providing your data to them.

15 Amendments to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements or Platform features. Material changes will be communicated to registered users via the email address associated with their account or by a prominent notice on the Platform prior to the effective date of the update.

The "Last reviewed" date at the top of this Policy reflects the most recent revision. Your continued use of the Platform following notification of a change constitutes your acceptance of the updated Policy. If you do not agree to changes, you must cease using the Platform and may request account closure.

We recommend reviewing this Policy periodically, even in the absence of a formal notification.

16 Contact Us

If you have questions about this Privacy Policy, wish to exercise a data right, report a suspected data breach or raise a privacy concern, please use the following channels:

• Live Chat: available 24/7 through the Platform — the fastest channel for account and privacy enquiries.
• Help Centre: self-service articles on data rights, account settings and KYC are accessible at all times through the Platform.
• Email (plain text — not a clickable link):
  [email protected]

We will acknowledge data rights requests within a reasonable timeframe and respond substantively within 30 days of receipt of a verified request, or within any shorter timeframe required by applicable law. We may request proof of identity before processing data rights requests to protect against unauthorised access to your data.