lak22 Privacy Policy

This Privacy Policy ("Policy") describes how lak22 ("lak22", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "the player", "the user") who access or use the lak22 online gaming platform available at lak22.net and its associated mobile interfaces.

lak22 is Pakistan's premier online gaming destination, serving players across Karachi, Lahore, Islamabad, Faisalabad, and cities and towns throughout the country. As a platform handling financial transactions via JazzCash, EasyPaisa, Raast, HBL, UBL, and Meezan Bank, and processing identity documents for KYC compliance, we recognise the sensitivity of the personal data we handle and take our data protection obligations seriously.

By registering an account with lak22, logging in, making a deposit, or otherwise using the lak22 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of and must be read together with the lak22 Terms & Conditions.

lak22 collects personal data through several means: information you provide directly during registration or account management, data generated automatically through your use of the platform, and information received from third-party service providers such as payment processors and identity verification agencies.

2.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, email address, mobile phone number registered in Pakistan, and chosen username and password.
• Identity Verification (KYC) Documents: Copies of your CNIC (Computerised National Identity Card) or passport, proof of address documents such as a utility bill or bank statement, and where required, proof of payment method ownership.
• Financial Data: Payment account details associated with JazzCash, EasyPaisa, Raast, or bank account information for HBL, UBL, and Meezan Bank transactions. Note: lak22 does not store full card or bank account numbers — only the masked reference information needed to process and reconcile your transactions.
• Communications Data: Any information you voluntarily share with lak22 through live chat, email to [email protected], or any feedback or complaint submissions.
• Responsible Gaming Preferences: Self-exclusion elections, deposit limits, session time limits, and cooling-off requests you submit through the lak22 responsible gaming tools.

2.2 Data Collected Automatically

• Device & Technical Data: IP address, device type, operating system version, browser type and version, screen resolution, and mobile network information.
• Usage Data: Pages visited, games played, bet history, session duration, clickstream data, and feature interactions on the lak22 platform.
• Location Data: Approximate geographic location derived from your IP address, used for fraud prevention and regulatory compliance. lak22 does not collect precise GPS location data.
• Cookie & Tracking Data: Data collected through cookies, session tokens, and similar technologies as described in Section 7 of this Policy.

2.3 Data Received from Third Parties

• Payment Processors: Transaction status, reference numbers, and verification confirmations from JazzCash, EasyPaisa, Raast, HBL, UBL, and Meezan Bank.
• Identity Verification Agencies: Confirmation of identity document authenticity and sanctions screening results from third-party KYC service providers.
• Fraud Prevention Services: Risk scores and fraud indicators from third-party fraud detection platforms that help lak22 identify and prevent suspicious account activity.

lak22 uses the personal data collected for the following specific and legitimate purposes. We do not use your data for any purpose not described in this Policy without first obtaining your consent or establishing a new lawful basis for doing so.

lak22 does not use personal data for automated decision-making that produces significant legal effects without human review, except as part of fraud detection systems where automated flags are always reviewed by a lak22 compliance officer before any account action is taken.

lak22 processes your personal data only where it has a lawful basis for doing so. The primary legal bases on which lak22 relies are set out below:

• Contractual Necessity: Processing required to fulfil our contract with you — including account registration, KYC verification, processing deposits and withdrawals, and managing your gaming activity — is undertaken because it is necessary to perform the services you have signed up for.
• Legal Obligation: lak22 is required to process certain categories of data to comply with applicable legal and regulatory requirements, including anti-money laundering laws, gaming regulations, and financial record-keeping obligations. This processing occurs regardless of your preferences.
• Legitimate Interests: lak22 processes certain data where it has a legitimate business interest in doing so and that interest is not overridden by your rights and freedoms. This includes fraud prevention, platform security, platform analytics, and responsible gaming monitoring.
• Consent: Where lak22 relies on your consent as the legal basis for processing — primarily for sending you promotional communications and setting non-essential cookies — you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted before the withdrawal.

lak22 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Data is shared with external parties only in the limited circumstances described below, and always subject to appropriate contractual data protection obligations.

• Payment Processors: To process your JazzCash, EasyPaisa, Raast, HBL, UBL, or Meezan Bank transactions, lak22 shares necessary payment reference data with the relevant payment service providers. These providers are bound by their own regulatory obligations as licensed financial institutions in Pakistan.
• Identity Verification Providers: lak22 shares identity document data with third-party KYC and AML screening providers solely for the purpose of verifying your identity and screening against sanctions lists. These providers process data under strict data processing agreements.
• Game Technology Providers: The third-party game studios and live dealer platform providers whose games are offered on lak22 may receive session data necessary to deliver and maintain the game experience. They do not receive your full personal profile.
• Fraud Prevention & Security Platforms: lak22 shares device fingerprinting and behavioural data with fraud detection technology providers to identify and prevent fraudulent account activity and bonus abuse.
• Regulatory & Law Enforcement Authorities: lak22 will disclose personal data to regulatory bodies, financial intelligence units, or law enforcement agencies where required to do so by law, court order, or regulatory directive. lak22 will not notify you of such disclosures where prohibited from doing so by applicable law.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale involving lak22, your personal data may be transferred to the acquiring entity as part of the transaction, subject to the same privacy protections described in this Policy.

lak22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements.

• Active Account Data: Data associated with your lak22 account is retained for the duration of your account's active status, plus a post-closure retention period as required by applicable gaming regulations and AML legislation.
• KYC & Identity Documents: Identity verification documents are retained for a minimum of five (5) years from the date of account closure or the last transaction, in accordance with standard AML record-keeping requirements.
• Transaction Records: Full transaction records, including deposits, withdrawals, bets placed, and game results, are retained for a minimum of five (5) years from the date of each transaction.
• Communications Data: Support communications and complaint records are retained for a minimum of three (3) years from the date of the last communication in a thread.
• Marketing Data: Where you have consented to receive marketing communications, your contact data and preference history are retained until you withdraw consent, at which point they are removed from active marketing lists within 30 days.
• Anonymised Analytics: Usage and behavioural data that has been irreversibly anonymised is not subject to retention limits and may be retained indefinitely for platform improvement purposes.

When personal data is no longer required for any of the above purposes and no legal obligation mandates its continued retention, lak22 will securely delete or irreversibly anonymise the data.

lak22 uses cookies, web beacons, pixel tags, and similar tracking technologies to operate and improve the platform, maintain your session security, and understand how players interact with lak22 content.

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to your lak22 account. Instructions for managing cookies in common browsers are available from the browser developer's support documentation.

lak22 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, accidental loss, disclosure, destruction, or alteration. Our security framework includes the following controls:

• Encryption in Transit: All data transmitted between your device and the lak22 platform is protected using TLS 1.2 or higher encryption. lak22 enforces HTTPS across all platform endpoints.
• Encryption at Rest: Sensitive personal data stored on lak22 servers is encrypted at rest using AES-256 encryption. This includes identity documents, payment references, and account credentials.
• Access Controls: Access to personal data is governed by a strict role-based access control (RBAC) system. Only authorised personnel with a demonstrated need to access specific data categories are granted access, and all access is logged and auditable.
• Two-Factor Authentication: lak22 supports two-factor authentication (2FA) via SMS OTP for player accounts, adding an additional layer of protection beyond the username and password.
• Penetration Testing: The lak22 platform undergoes regular security assessments and penetration testing by qualified independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: lak22 maintains a documented security incident response plan. In the event of a confirmed data breach, affected players will be notified promptly with details of the breach, the data involved, and the steps being taken to address it.

While lak22 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. You play an important role in keeping your account secure by using a strong, unique password and never sharing your lak22 credentials with any other person.

Subject to applicable law and certain limited exceptions, you have the following rights in respect of your personal data held by lak22. To exercise any of these rights, contact the lak22 Data Privacy team at [email protected] with the subject line "Data Rights Request" and include your registered username and a description of the right you wish to exercise.

• Right of Access: You have the right to request a copy of the personal data lak22 holds about you and information about how it is being processed. lak22 will respond to access requests within 30 days.
• Right to Rectification: If any personal data lak22 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain information directly through your lak22 account settings panel.
• Right to Erasure: In certain circumstances — such as where data is no longer necessary for the purposes for which it was collected, or where you withdraw consent — you may request deletion of your personal data. This right is subject to overriding legal obligations, such as AML record-keeping requirements, which may prevent immediate deletion.
• Right to Restrict Processing: You may request that lak22 restricts processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of your personal data to transfer to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interests or carried out for direct marketing purposes. lak22 will honour objections to direct marketing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The lak22 platform is strictly for adults aged 21 years and older. lak22 does not knowingly collect, use, or store personal data from any individual under the age of 21. If lak22 discovers or has reasonable grounds to believe that an account has been registered by a person under the age of 21, the account will be immediately suspended, all balances will be withheld pending investigation, and the personal data associated with the account will be securely deleted.

If you are a parent or guardian and believe that your child or a minor in your care has submitted personal data to lak22, please contact us immediately at [email protected] with the subject line "Underage Account Concern". lak22 will investigate the report promptly and take appropriate action, including account closure and data deletion where confirmed.

lak22 employs age verification as part of its mandatory KYC process, requiring players to submit government-issued identity documents confirming they are at least 21 years of age before a withdrawal can be processed and before full account features are enabled.

The lak22 platform may contain references to or integrations with third-party services, including but not limited to payment gateways and game studio interfaces. While lak22 takes reasonable care in selecting its third-party partners, this Privacy Policy applies only to data processing carried out by lak22 directly.

Third-party services operated by payment processors such as JazzCash and EasyPaisa, or game providers integrated within the lak22 platform, are governed by their own separate privacy policies. lak22 encourages you to review the privacy policies of any third-party services you interact with through the lak22 platform.

lak22 is not responsible for the privacy practices, data handling procedures, or security measures of third-party operators, and any data you submit directly to a third-party service is subject to that party's own terms and policies, not lak22's.

lak22 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When material changes are made — meaning changes that affect your rights or the fundamental nature of how we use your data — lak22 will notify you through one or more of the following channels:

• A prominent notice displayed upon your next login to your lak22 account.
• An email notification to your registered email address, clearly identifying the nature of the changes.
• A notice published on the lak22 website with a revised "Last Updated" date at the top of this Policy.

Non-material changes — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to contact details — may be made without advance notice. The "Last Updated" date at the top of this page will always reflect when the most recent version was published.

Your continued use of the lak22 platform following publication of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the updated Policy, you should cease using the platform and contact lak22 to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way lak22 handles your personal data, please contact the lak22 Data Privacy team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Query" or "Data Rights Request" as appropriate.
• Live Chat: Available 24 hours a day, 7 days a week through the lak22 platform for general privacy questions.
• Response Time: lak22 aims to acknowledge all privacy-related email enquiries within 48 hours and provide a full substantive response within 30 days for formal data rights requests.

When contacting us about a privacy matter, please include your registered lak22 username and the email address on your account so we can locate your records and respond accurately. lak22 will verify your identity before actioning any request that involves disclosing or deleting personal data.

This Privacy Policy was last reviewed and updated on 1 January 2026. lak22 recommends revisiting this page periodically. Continued use of lak22 confirms your acceptance of the most current version of this Policy.