Privacy Policy —
How rpk888 Protects Your Data

This Privacy Policy ("Policy") describes how rpk888 ("rpk888", "we", "us", "our", "the Platform") collects, uses, stores, discloses and protects the personal data of individuals ("User", "you", "your") who access or use the website located at https://rpk888.cam and any associated services, features or applications (collectively, the "Service").

rpk888 is committed to protecting the privacy and security of your personal information. This Policy is designed to be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. By using the Service, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein, where consent forms the lawful basis for processing.

If you do not agree with any aspect of this Privacy Policy, you must discontinue use of the Service immediately. Where your continued use of the Service is required for legal or regulatory compliance purposes (for example, ongoing KYC review of an existing account), data processing may continue irrespective of your consent, where another lawful basis applies.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

rpk888 collects Personal Data through the following channels and in the following categories:

3.1 Data Provided Directly by You

• Registration Data: Full legal name, email address, date of birth, country of residence, username and password (stored in hashed form — we never store plaintext passwords);
• KYC & Verification Documents: Government-issued photo identification (e.g., Pakistani CNIC, passport or driving licence), proof of address documents (e.g., utility bill or bank statement from your city — Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar), and proof of payment method ownership;
• Payment Information: Bank account details, mobile wallet information (where applicable as a payment rail reference), transaction history and billing address. Note: rpk888 does not store full card numbers — payment card data is tokenised and handled exclusively by PCI-DSS compliant payment processors;
• Communications: Content of support communications, dispute submissions, feedback forms and any correspondence you send to our support team at [email protected].

3.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone, language settings and referring URL;
• Usage Data: Pages visited, session duration, clickstream data, search queries on the Platform and feature interactions;
• Betting & Gaming Activity: Wager history, game session data, win/loss records, bonus usage and live-betting activity logs — retained for regulatory compliance and responsible gambling monitoring purposes;
• Cookies & Tracking Technologies: Data collected via cookies, local storage and similar technologies as described in Section 7 of this Policy.

rpk888 processes Personal Data only where a recognised lawful basis exists under applicable data protection law. The primary lawful bases we rely upon are as follows:

• Contractual Necessity: Processing necessary to perform the contract between you and rpk888 — including account management, transaction processing, KYC fulfilment and the provision of betting and gaming services;
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, responsible gambling requirements, tax reporting and regulatory record-keeping mandates;
• Legitimate Interests: Processing where rpk888 has a legitimate interest that is not overridden by your rights — including fraud prevention, platform security, abuse detection and the improvement of service quality through aggregated analytics;
• Consent: Processing based on your explicit, freely given and revocable consent — including optional marketing communications, non-essential cookies and certain analytics activities. You may withdraw consent at any time without detriment to your account.

Where processing is based on legitimate interests, we conduct and document a Legitimate Interests Assessment (LIA) to ensure your fundamental rights are not disproportionately affected.

rpk888 uses collected Personal Data for the following specific purposes:

• Account Management: Creating, maintaining and managing your registered account, including authentication, password management and session control;
• Identity Verification & Compliance: Conducting KYC checks, verifying age eligibility (18+ or the higher minimum required by the operator/licence jurisdiction), and fulfilling AML obligations in accordance with applicable regulatory frameworks;
• Transaction Processing: Processing deposits and withdrawals, verifying payment method ownership, and maintaining transaction records for audit and regulatory purposes;
• Service Delivery: Providing access to sports betting markets, casino games and associated features of the rpk888 Platform;
• Customer Support: Responding to queries, resolving disputes, processing account modification requests and handling responsible gambling requests submitted to [email protected];
• Responsible Gambling Monitoring: Analysing betting and gaming behaviour to identify indicators of problem gambling, applying responsible gambling controls, enforcing self-exclusion periods and complying with operator-level duty-of-care obligations;
• Platform Security & Fraud Prevention: Detecting, investigating and preventing unauthorised access, fraudulent activity, multi-accounting, bonus abuse and other integrity violations;
• Legal & Regulatory Obligations: Maintaining records required by law, cooperating with regulatory enquiries and fulfilling reporting obligations to competent authorities;
• Analytics & Improvement (aggregated): Using aggregated, anonymised usage data to understand platform performance and improve user experience — this does not involve individual-level profiling for marketing purposes without consent;
• Marketing Communications (with consent): Sending promotional emails, bonus notifications and platform updates to Users who have opted in to receive such communications. Opt-out is available at any time via the unsubscribe link in any marketing email or by contacting support.

rpk888 does not sell, rent or trade your Personal Data. We share data only in the following strictly defined circumstances:

• KYC & Identity Verification Providers: Third-party identity verification services engaged to perform document authentication and age verification in support of KYC compliance. These providers act as Data Processors under binding data-processing agreements;
• Payment Processors: PCI-DSS compliant payment service providers engaged to facilitate deposit and withdrawal transactions. Financial data shared with processors is limited to what is strictly necessary for transaction completion;
• Technology Partners: Software, gaming, analytics and infrastructure providers who access data solely for the purpose of delivering the technical service for which they are engaged. All are bound by confidentiality and data protection obligations;
• Legal & Regulatory Authorities: Competent authorities, regulators, law enforcement agencies or courts where disclosure is required by law, court order or regulatory mandate. This includes AML reporting obligations. rpk888 will notify you of such disclosures where legally permissible;
• Business Transfers: In the event of a corporate restructuring, merger, acquisition or sale of assets, Personal Data may be transferred to the successor entity, subject to equivalent data protection standards. Users will be notified of any such transfer.

rpk888 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit the website. The following categories of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function — including session management, authentication, security tokens and load balancing. These cannot be disabled without impacting core functionality;
• Functional Cookies: Remember your preferences — such as language selection, odds format and responsible gambling tool settings — to personalise your experience across sessions;
• Analytics Cookies: Collect aggregated, anonymised data about how Users interact with the Platform to enable performance monitoring and improvement. Analytics data does not identify you individually;
• Marketing Cookies (with consent): Used to deliver relevant communications and measure the effectiveness of promotional campaigns, where you have provided explicit consent. Marketing cookies are not placed without your prior consent.

You may manage cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the Platform. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

rpk888 implements a comprehensive set of technical and organisational security measures to protect your Personal Data from unauthorised access, accidental loss, alteration, disclosure or destruction. Key measures in place include:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using 256-bit SSL/TLS protocols — the same standard used by major financial institutions;
• Encryption at Rest: Sensitive personal data, including identity documents and financial information, is encrypted at rest in our secure data storage infrastructure;
• Password Security: Passwords are stored using industry-standard one-way cryptographic hashing with salting. Plaintext passwords are never stored or transmitted;
• Access Controls: Internal access to Personal Data is strictly controlled on a need-to-know basis. All staff with access to Personal Data receive data protection training and are bound by confidentiality obligations;
• Intrusion Detection: Automated monitoring systems are deployed to detect and alert on suspicious activity, unauthorised access attempts and anomalous data access patterns;
• Incident Response: rpk888 maintains a documented data breach response procedure. Where a breach is likely to result in a high risk to your rights and freedoms, you will be notified without undue delay in accordance with applicable data protection law.

Despite these measures, no data transmission over the internet or method of electronic storage is 100% secure. Users are responsible for maintaining the security of their login credentials and should contact [email protected] immediately if they suspect unauthorised account access.

rpk888 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account relationship with rpk888, plus any legally mandated post-closure retention period;
• KYC & Identity Documents: Retained for a minimum of five (5) years following account closure, or longer where required by AML regulations or regulatory instruction;
• Transaction Records: Retained for a minimum of five (5) years from the date of transaction for financial audit, tax and regulatory compliance purposes;
• Betting & Gaming Activity Logs: Retained for a minimum of three (3) years from the date of activity for compliance, dispute resolution and responsible gambling monitoring purposes;
• Support Correspondence: Retained for a minimum of two (2) years from the date of final correspondence for dispute resolution and quality assurance purposes;
• Marketing Consent Records: Retained for the duration of your consent, plus a reasonable period thereafter as evidence of compliance.

Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with rpk888's data destruction procedures. Anonymised, aggregate data may be retained indefinitely for statistical and analytical purposes, as it can no longer identify any individual.

Subject to applicable law, you hold the following rights in relation to your Personal Data processed by rpk888. Requests may be submitted to [email protected] with the subject line "Data Subject Request":

rpk888 will respond to data subject requests within thirty (30) days of receipt. Where a request is complex or numerous, this period may be extended by a further two months, with notification provided within the initial thirty-day window. We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

Where you believe your rights have been infringed, you may lodge a complaint with the supervisory authority in the jurisdiction in which rpk888 holds its operating licence.

The rpk888 Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the operator's licence jurisdiction or applicable local law. We do not knowingly collect Personal Data from minors.

If rpk888 discovers that Personal Data has been collected from a person under the minimum eligible age, the associated account will be suspended immediately, all funds withheld pending investigation, and the data deleted as soon as practicable, subject to any applicable regulatory hold obligations.

If you believe a minor has registered on the rpk888 Platform, please notify us immediately at [email protected]. We take child protection obligations extremely seriously and will act promptly on any substantiated report.

The rpk888 Platform does not include links to external third-party websites as a matter of policy. Where any reference to external payment service providers, sports leagues or other services appears on the Platform, such references are provided for contextual information only and do not constitute an endorsement, affiliation or data-sharing arrangement.

rpk888 is not responsible for the privacy practices of any third-party services that you may access independently in connection with your use of the Platform (for example, your bank, mobile wallet provider or internet service provider). You should review the relevant privacy notices of those services separately.

rpk888 operates internationally and may process Personal Data in jurisdictions other than your country of residence. Where Personal Data is transferred outside the jurisdiction in which it was collected, rpk888 ensures that appropriate safeguards are in place to protect your data to an equivalent standard. Applicable transfer mechanisms may include:

• Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority;
• Data processing agreements incorporating equivalent data protection obligations;
• Transfers to jurisdictions recognised by the relevant supervisory authority as providing adequate data protection.

Details of the specific transfer mechanisms applicable to your Personal Data are available upon request to [email protected].

rpk888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law or regulatory requirements. Where amendments are material, rpk888 will notify registered Users in advance by email or by prominent on-site notice, with the updated "Last Updated" date reflected at the top of this page.

Your continued use of the Service following the effective date of any amendment constitutes acknowledgement of the revised Policy. If you do not accept the amended terms, you may request account closure in accordance with the process described in our Terms & Conditions. The most current version of this Privacy Policy is always available at https://rpk888.cam/privacy-policy.

For any questions, concerns or requests relating to this Privacy Policy or your Personal Data, please contact the rpk888 data protection team using the details below. All data subject requests must be submitted in writing and will be handled in accordance with applicable data protection law.

Support is available 24 hours a day, 7 days a week, in English and with Urdu assistance available. When submitting a data subject request, please include sufficient information to verify your identity — typically your registered email address and, where necessary, a copy of a government-issued photo ID.