TossPK Privacy Policy — How We Handle Your Data

TossPK ("the Platform", "we", "us", "our") is an English-language online betting information platform operated for Pakistani users, accessible at https://tosspk.cam. We are committed to protecting the privacy of every individual who accesses or uses the Platform ("User", "you", "your").

This Privacy Policy ("Policy") sets out in clear, structured terms: what personal data we collect from you; the purposes for which we process it; the legal grounds on which we rely; how long we retain it; the circumstances in which we may share it; and the rights you hold over your data. It also describes the security measures we apply and explains how to contact us with any data-related query or complaint.

This Policy applies to all personal data collected through the TossPK website, including via registration forms, contact submissions, account activity and automated technical means such as cookies. It does not govern the data practices of any third-party operator or payment provider referenced on this Platform — those parties maintain their own separate privacy policies, which you should read independently.

The following terms have the meanings assigned to them below throughout this Policy:

TossPK collects personal data in the following categories. We collect only data that is necessary for the purposes described in Section 5 of this Policy.

3.1 Registration & Account Data. When you create an account on TossPK, we collect:

• Full legal name
• Date of birth (for age verification purposes)
• Email address
• Username and hashed password credentials
• Country and city of residence (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar)

3.2 Identity Verification (KYC) Data. Where required for compliance or account verification, we may collect:

• Government-issued identity document (e.g., NADRA CNIC for Pakistani users, passport, national ID)
• Proof of address documentation
• Proof of payment method (where applicable)
• Selfie or liveness-check image (where required by verification process)

3.3 Financial & Transaction Data. Where transactions are initiated through the Platform (for example, directing a user to an operator's cashier), we may record:

• Payment method type selected (e.g., mobile wallet, bank transfer — not full card numbers)
• Transaction reference identifiers
• Currency denomination (PKR or other as applicable)

3.4 Technical & Usage Data. Automatically collected when you visit or interact with the Platform:

• IP address and approximate geolocation derived from IP
• Browser type, version and language settings
• Device type and operating system
• Pages visited, time spent on page, click-path data
• Referral URL (the page you visited before arriving at TossPK)
• Session identifiers and cookie data (see Section 10)

3.5 Communications Data. If you contact TossPK via Live Chat, Help Centre or email:

• The content of your message
• Contact channel and timestamp
• Any personal information voluntarily provided in the communication

Personal data is collected through the following means:

• Directly from you: When you register an account, submit identity documents, contact our support team or interact with Platform features such as preference settings or feedback forms.
• Automatically: Through cookies, web beacons, server logs and similar tracking technologies when you browse the Platform (see Section 10).
• From third parties: Identity verification service providers conducting KYC checks on our behalf; analytics partners providing aggregated usage statistics; fraud-prevention services. All such third parties operate under data processing agreements with TossPK.
• From publicly available sources: In limited circumstances, for fraud-prevention or compliance purposes, we may cross-reference information against publicly available databases or sanctions lists.

TossPK processes your personal data for the following clearly defined purposes:

TossPK does not process your personal data for purposes incompatible with those listed above without first providing notice and, where required by applicable law, obtaining your consent.

TossPK processes personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to provide you with the Platform's services under the Terms & Conditions you accepted at registration — for example, account creation, identity verification and platform access.
• Legal obligation: Processing required to comply with applicable AML, KYC, CTF or other regulatory requirements — for example, retaining transaction records or identity documents for a prescribed period.
• Legitimate interests: Processing undertaken for TossPK's legitimate business interests where those interests are not overridden by your privacy rights — for example, fraud prevention, platform security and aggregate analytics. We conduct balancing tests before relying on this basis.
• Consent: Where required by applicable law — for example, in connection with non-essential cookies or certain marketing communications — we will seek and record your explicit consent before processing. You may withdraw consent at any time without affecting the lawfulness of prior processing.

TossPK does not sell, rent or trade your personal data to third parties. We may share personal data only in the following limited circumstances:

• Service Providers (Data Processors): Third-party companies that process data on our behalf under contractual data processing agreements — including identity verification providers, cloud hosting services, analytics platforms and customer support tools. These processors are permitted to use your data only as instructed by TossPK.
• Third-Party Operators: Where you explicitly choose to proceed to a referenced operator's platform, certain data (such as your registered email or referral identifier) may be passed to that operator as part of the referral flow. That operator's own privacy policy then governs the data you provide to them.
• Regulatory & Legal Authorities: Where required by applicable law, court order, regulatory request or to protect against fraud, we may disclose personal data to law enforcement agencies, regulators or other government bodies. We will notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of TossPK's business or assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

TossPK retains personal data only for as long as is necessary for the purposes described in this Policy or as required by applicable law. The following principles govern our retention practices:

• Account data is retained for the duration of your active account relationship with TossPK, and for a reasonable period thereafter to enable account reactivation, resolve disputes or address regulatory inquiries.
• KYC and identity documents are retained for the period prescribed by applicable AML and KYC regulations in the operator's license jurisdiction — typically a minimum of five years from the date of last activity or account closure.
• Transaction records are retained in accordance with applicable financial regulatory obligations, generally for a minimum of five years.
• Support communications are retained for a period sufficient to resolve the matter and address any subsequent disputes, typically up to three years.
• Technical and usage data collected via cookies or server logs is retained for shorter periods appropriate to its purpose — generally 12 to 24 months for analytics data, and shorter periods for session-specific data.

When personal data is no longer required for its purpose and retention is not required by law, TossPK securely deletes or anonymises it.

TossPK implements appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures include but are not limited to:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the Platform.
• Encrypted storage of passwords and sensitive credential data — we do not store passwords in plain text.
• Access controls restricting personal data access to authorised staff and processors with a legitimate need.
• Regular security reviews of Platform infrastructure and data handling processes.
• Incident response procedures for identifying, containing and notifying affected parties of any data security breach in accordance with applicable law.

TossPK uses cookies and similar tracking technologies to operate and improve the Platform. This section explains the types of cookies used and your choices regarding them.

10.1 Types of Cookies Used.

10.2 Managing Cookies. Most browsers allow you to control cookies through their settings — you can block, restrict or delete cookies at the browser level. Note that blocking strictly necessary cookies may impair your ability to use certain Platform features. For optional cookies, where required by applicable law, we will seek your consent before placing them.

TossPK's Platform and services may involve the transfer of personal data to countries outside of Pakistan, including to jurisdictions in which our cloud hosting providers, identity verification services and other data processors are located.

Where personal data is transferred outside of Pakistan, TossPK takes reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy and applicable data protection principles. Such safeguards may include contractual clauses with the receiving entity, reliance on the recipient's participation in recognised privacy frameworks, or other mechanisms recognised under applicable law.

By using the TossPK Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Pakistan. If you have concerns about specific international transfers, please contact us using the details in Section 16.

Depending on the data protection laws applicable in your jurisdiction, you may hold some or all of the following rights in relation to your personal data held by TossPK. We are committed to facilitating the exercise of these rights promptly and without undue delay.

To exercise any of the above rights, please contact TossPK using the details provided in Section 16. We may need to verify your identity before processing a request. We will respond within the timeframe required by applicable law — generally within 30 days of receiving a verified request.

TossPK is strictly an adults-only platform. The Platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 18 — or the higher minimum age required by the operator's license jurisdiction or the applicable law in the user's country of residence.

If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data and close the associated account. Meeting the minimum age requirement does not constitute confirmation that gambling is lawful in the user's jurisdiction, including Pakistan.

Parents or guardians who believe that their child has provided personal data to TossPK without authorisation are encouraged to contact us immediately using the details in Section 16.

The TossPK Platform may reference or direct users towards third-party betting operators and gaming platforms. Once you leave the TossPK Platform and access a third-party service, your activity and the personal data you provide are governed by that third party's own privacy policy — not by this Policy.

TossPK is not responsible for the privacy practices, data security measures or content of any third-party service. We strongly encourage you to read the privacy policy of any third-party operator before providing personal data, making deposits or engaging in betting or gaming activity on their platform.

The presence of a reference to a third-party operator on TossPK does not constitute an endorsement of that operator's privacy practices, data security standards or compliance posture.

TossPK reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law or Platform functionality. When we make material changes, we will update the "Last Updated" date displayed at the top of this page. Where changes are significant, we will endeavour to provide additional notice — for example, a notification within your account or a banner on the Platform homepage.

Your continued use of the TossPK Platform after the effective date of a revised Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with a material change, you should cease using the Platform and may request deletion of your account and personal data by contacting us as described in Section 16.

We recommend bookmarking this page and reviewing it periodically — particularly before engaging with any new Platform features or referenced services.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how TossPK handles your personal data, please contact our Data Privacy team using the information below.

For urgent account security matters, use the Live Chat available on the Platform. For formal data-related correspondence — including Subject Access Requests, erasure requests or complaints:

16.1 Complaints. If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. TossPK commits to cooperating in good faith with any investigation by a competent supervisory authority.

16.2 Support Availability. TossPK's support team is available 24/7. English and Urdu assistance channels are available — please check the Help Centre on the Platform for current channel options. Email addresses and contact details on this page are displayed as plain text only and are not clickable links.