1. Data Controller
brtpkr acts as the data controller in respect of all personal data collected through the brtpkr Platform. As data controller, brtpkr determines the purposes for which personal data is processed and the means by which that processing occurs, in accordance with the obligations imposed by brtpkr's internationally recognized Gaming License and applicable data protection frameworks.
The data controller's primary point of contact for data protection enquiries is brtpkr's compliance and privacy team, reachable at [email protected] (displayed as plain text — not a clickable link). Enquiries relating specifically to personal data rights, data access requests, and data deletion requests should be clearly marked "Privacy – Data Request" in the subject of your written communication to ensure routing to the correct team.
2. Categories of Personal Data Collected
brtpkr collects personal data across several categories, each of which is necessary for one or more of the legitimate purposes described in Section 4. The categories of personal data currently collected by brtpkr include:
| Category | Specific Data Points | Necessity |
|---|---|---|
| Identity Data | Full legal name, date of birth, CNIC number, CNIC scan or photograph | KYC / Age verification / AML compliance |
| Contact Data | Pakistani mobile number, email address (where provided) | Account creation, OTP delivery, support communications |
| Financial Data | JazzCash/EasyPaisa account numbers, bank account details, deposit and withdrawal history, PKR wallet transaction records | Payment processing, AML monitoring, withdrawal verification |
| Gaming Activity Data | Games played, bet amounts, win/loss records, session durations, PSL and sports betting history | Platform operation, responsible gaming monitoring, licensing compliance |
| Technical Data | IP address, device type, browser type, operating system, mobile network (Jazz/Telenor/Zong/Ufone), session logs | Security, fraud detection, platform optimization |
| Responsible Gaming Data | Deposit limits set, cool-off periods activated, self-exclusion requests, support interactions related to problem gambling | Licensing obligation, player protection, regulatory reporting |
| Communications Data | Live chat transcripts, support ticket content, email correspondence with brtpkr | Dispute resolution, quality assurance, compliance records |
3. How Personal Data Is Collected
brtpkr collects personal data through the following channels and methods:
- Direct registration: When you create a brtpkr account, you actively provide your mobile number, chosen password, and basic profile information. This is the primary point of initial data collection on the Platform.
- KYC submission: When you submit CNIC documentation for identity verification, brtpkr collects the identity data contained in those documents, including your legal name, CNIC number, date of birth, and the photographic image on the CNIC.
- Payment transactions: Each deposit and withdrawal processed through the brtpkr PKR wallet generates transaction records containing payment method identifiers, PKR amounts, timestamps, and processing status data.
- Gameplay and betting activity: The brtpkr platform automatically records all gaming sessions, bet placements, game outcomes, win and loss amounts, and session durations as part of normal platform operation and licensing compliance.
- Technical collection: brtpkr's servers automatically receive and record technical information from your device when you access the Platform, including IP addresses, device identifiers, browser characteristics, and mobile network information from Pakistani carriers.
- Customer support interactions: When you contact brtpkr's support team via live chat, email, or any other communication channel, the content of those communications is recorded for compliance, quality assurance, and dispute resolution purposes.
- Cookies and tracking technologies: As described in Section 8, brtpkr uses cookies and similar technologies to collect usage data and session information from Platform visitors.
4. Purposes of Processing & Legal Basis
brtpkr processes personal data for specific, documented purposes, each of which rests on a recognized legal basis under applicable data protection law. The primary purposes and their corresponding legal bases are as follows:
- Account creation and management — Performance of contract with the registered member;
- Processing deposits and withdrawals in PKR — Performance of contract; legal obligation (payment regulation);
- KYC identity and age verification — Legal obligation under brtpkr's Gaming License; compliance with applicable AML regulations;
- Fraud detection and prevention — Legitimate interests of brtpkr in maintaining platform integrity and protecting members from fraud;
- Responsible gaming monitoring and enforcement — Legal obligation under Gaming License; legitimate interest in player welfare;
- Customer support and dispute resolution — Performance of contract; legitimate interest in resolving complaints fairly;
- Platform performance and security monitoring — Legitimate interest in operating a secure and reliable platform;
- Regulatory reporting to licensing authority — Legal obligation under Gaming License;
- Marketing communications (where opted in) — Consent of the data subject.
brtpkr does not process personal data for any purpose not listed above without first obtaining explicit consent or establishing a new documented legal basis for the additional processing activity.
5. KYC & CNIC Data Handling
brtpkr's KYC process requires all members to submit a copy or clear photograph of their Pakistani National Identity Card (CNIC) before processing withdrawal requests beyond minimum threshold amounts. KYC may also be required at registration or during an account review triggered by unusual activity patterns or large transaction volumes.
5.1 CNIC Data Storage
CNIC images and extracted identity data are stored on brtpkr's secure, access-controlled servers with encryption at rest. Access to CNIC data is restricted to brtpkr compliance personnel with a documented need to access it as part of their KYC review duties. CNIC data is not accessible to customer support staff, marketing teams, or any other personnel without documented compliance justification.
5.2 Third-Party KYC Processors
brtpkr may utilize third-party KYC verification service providers to assist in the processing and verification of CNIC documents. Any such provider is required to be bound by a data processing agreement that restricts their use of CNIC data exclusively to the KYC verification service and prohibits secondary use, onward transfer, or retention beyond the verification purpose. brtpkr remains the data controller in all such arrangements and is responsible for the acts of any KYC processor operating on its behalf.
5.3 Retention of KYC Records
KYC records, including CNIC copies and verification decisions, are retained for a minimum period required by brtpkr's Gaming License and applicable AML regulations. Upon expiry of the required retention period, KYC records are securely deleted or anonymized in accordance with brtpkr's data retention schedule, as described in Section 9.
6. PKR Wallet & Payment Data
All financial transactions on the brtpkr Platform are denominated in Pakistani Rupees (PKR). Transaction data associated with JazzCash deposits, EasyPaisa withdrawals, HBL/UBL/Meezan/MCB/Allied Bank/Bank Al Falah bank transfers, SadaPay, and USDT TRC20 transactions is processed and retained as follows:
6.1 Payment Processor Sharing
To process PKR deposits and withdrawals, brtpkr necessarily shares transaction data with payment processors, Pakistani banking partners, and mobile money operators such as JazzCash and EasyPaisa. This sharing is limited to the minimum data necessary to complete the specific transaction. brtpkr does not grant payment processors ongoing access to your gaming activity data or full account information beyond what is required for the individual payment event.
6.2 Transaction Records
brtpkr maintains complete records of all PKR wallet transactions for a period of at least five (5) years from the date of each transaction, as required by brtpkr's Gaming License and applicable financial record-keeping obligations. These records include transaction timestamps, PKR amounts, payment method identifiers, and transaction status. They may be required to be produced to regulatory or law enforcement authorities under applicable legal processes.
6.3 Segregated Account Confidentiality
Information relating to the segregated accounts in which brtpkr holds player PKR funds is treated as confidential financial information and is not disclosed to any party other than brtpkr's licensed banking partners and its Gaming License regulatory authority in the course of regulatory oversight.
7. Data Sharing & Third-Party Disclosure
brtpkr does not sell, rent, or trade personal data belonging to brtpkr members to any third party for commercial purposes. Data is shared with third parties only in the limited circumstances described below:
- Gaming License Regulatory Authority: brtpkr is required to provide player data, gaming activity reports, and responsible gaming records to its Gaming License regulatory authority upon request as part of ongoing licensing compliance. This disclosure is mandatory and cannot be refused.
- Payment Service Providers: Financial data necessary to process specific PKR transactions is shared with relevant payment processors (JazzCash, EasyPaisa, Pakistani banks) on a transaction-by-transaction basis.
- KYC and AML Service Providers: CNIC and identity data may be shared with accredited third-party KYC verification and AML screening service providers, subject to binding data processing agreements.
- Game Content Providers: brtpkr shares necessary session and bet data with casino game providers (such as Pragmatic Play, PG Soft, Evolution Gaming) to operate their games on the Platform. This sharing is governed by contractual provisions restricting providers' use of data to game delivery purposes only.
- Law Enforcement and Legal Process: brtpkr will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or regulatory direction. brtpkr will notify affected members of such disclosures to the extent permitted by the relevant legal process.
- Fraud Prevention Agencies: Where brtpkr identifies suspected fraud, money laundering, or other criminal activity, relevant personal data may be shared with fraud prevention agencies and other online gaming operators through industry fraud-sharing frameworks, as permitted by applicable law.
- Corporate Transactions: In the event of a merger, acquisition, or sale of brtpkr's business or assets, personal data held by brtpkr may be transferred to the acquiring entity, subject to that entity being bound by the same or equivalent privacy obligations as those set out in this Policy.
8. Cookies & Tracking Technologies
The brtpkr Platform uses cookies, local storage, and similar browser technologies to enhance the user experience, maintain login sessions, and collect analytics data. The following categories of cookies are used on brtpkr.net:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Maintain login session state, CSRF protection tokens, language preferences, security flags. Required for Platform operation; cannot be disabled. | Session / 30 days | |
| Remember game lobby preferences, last-played game positions, casino filter settings, responsible gaming reminder display intervals. | Up to 90 days | |
| Anonymous aggregated page view data, navigation paths, feature usage rates. Used to improve Platform performance and user experience. No individual user profiling. | Up to 365 days |
Users may manage cookie preferences through their browser settings. Disabling essential cookies may prevent certain Platform features from functioning correctly, including maintaining a logged-in session across page navigations. brtpkr does not use cookies for third-party advertising purposes or for building profiles of individual users for sale to advertisers.
9. Data Retention
brtpkr retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, taking into account any additional retention periods mandated by brtpkr's Gaming License, applicable AML regulations, tax laws, and general legal hold obligations. The general retention schedule applied by brtpkr is as follows:
- Account and identity data: Retained for the duration of the active account relationship plus a minimum of five (5) years following account closure, as required by Gaming License obligations;
- KYC and CNIC records: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable AML regulation;
- Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction;
- Gaming activity records: Retained for a minimum of three (3) years from the date of each session, or five (5) years where required by licensing compliance;
- Customer support communications: Retained for three (3) years from the date of the support interaction;
- Responsible gaming records: Retained for five (5) years from the date of any self-exclusion, cool-off activation, or problem gambling support interaction;
- Technical and log data: Typically retained for 12 months from collection, subject to security investigation requirements.
Upon expiry of the applicable retention period, personal data is either securely deleted using industry-standard deletion methods or irreversibly anonymized so that it can no longer be attributed to any individual. Anonymized data retained beyond these periods cannot be re-identified and is not subject to data subject rights requests.
10. Data Security
Technical and organizational security measures implemented by brtpkr include:
- 256-bit SSL/TLS encryption for all data transmitted between users' devices and brtpkr's servers, including during brtpkr Login sessions, PKR wallet transactions, and KYC document uploads;
- Encryption at rest for all databases containing sensitive personal data, including CNIC records, financial transaction histories, and responsible gaming records;
- Role-based access controls ensuring that brtpkr personnel can only access personal data categories relevant to their documented job functions;
- Multi-factor authentication required for all brtpkr administrative system access;
- Regular penetration testing and vulnerability assessments conducted by qualified third-party security specialists;
- 24/7 security monitoring with automated alerts for unusual access patterns or data transfer anomalies;
- Staff data protection training conducted on an annual basis for all personnel with access to personal data;
- Incident response procedures that include notification protocols for data breaches affecting member personal data.
Despite these measures, no online platform can guarantee absolute security of data transmitted over the internet. brtpkr strongly encourages all members to use strong, unique passwords for their brtpkr account, to enable OTP two-factor authentication, and to avoid accessing their account from shared or public devices.
11. Your Data Rights
Subject to applicable law and the legitimate overriding interests of brtpkr in fulfilling its licensing, AML, and legal obligations, registered members and individuals whose personal data is held by brtpkr have the following rights:
To exercise any of these rights, contact brtpkr's privacy team at [email protected] with the subject line "Privacy – Data Rights Request." Include your registered mobile number and a description of the right you wish to exercise. brtpkr will respond within 30 days and may request identity verification before processing your request.
12. Minors & Age Restriction Policy
CNIC-based KYC verification is brtpkr's primary mechanism for enforcing the 21-year minimum age requirement. Where KYC documents indicate that a registered member is below the age of 21, the account is suspended immediately and the data deletion process described above is initiated. brtpkr cooperates with any regulatory or law enforcement investigation arising from underage access attempts.
13. International Data Transfers
brtpkr's server infrastructure and those of some of its data processors may be located outside Pakistan. Where personal data is transferred outside Pakistan for processing — for example, to gaming platform infrastructure providers, KYC service providers, or game content studios — brtpkr ensures that adequate safeguards are in place to protect the transferred data to a standard equivalent to that required by brtpkr's Gaming License obligations and this Privacy Policy.
Safeguards used by brtpkr for international data transfers include: standard contractual clauses incorporated into data processing agreements with international processors; adequacy assessments confirming the relevant jurisdiction provides equivalent data protection standards; and where applicable, supplementary technical measures such as data minimization and pseudonymization prior to transfer.
14. Marketing Communications & Opt-Out
brtpkr may send registered members promotional communications regarding new games, bonus offers, PSL betting promotions, and other platform news via SMS to the registered Pakistani mobile number. Marketing communications are sent only where the member has not opted out of such communications.
Members may opt out of marketing communications at any time by:
- Navigating to Account Settings on the brtpkr Platform and updating communication preferences;
- Contacting brtpkr's support team at [email protected] with an opt-out request; or
- Following the opt-out instructions included in any marketing message received from brtpkr.
Opting out of marketing communications does not affect transactional messages — brtpkr will continue to send OTP verification codes, deposit confirmation notifications, withdrawal status updates, and security alerts to your registered mobile number as these are necessary for the operation of your Account and cannot be disabled.
15. Third-Party Content & Links
The brtpkr Platform may include game content provided by third-party studios (such as Pragmatic Play, PG Soft, and Evolution Gaming) embedded within the Platform interface. While brtpkr regulates the use of your data by these providers through contractual data processing agreements, each provider also maintains their own privacy policies governing their independent data processing activities. brtpkr is not responsible for the privacy practices of third-party game providers in their capacity as independent controllers of their own game systems. brtpkr recommends reviewing the privacy documentation of any third-party provider if you have specific concerns about their independent data practices.
16. Responsible Gaming Data & Special Protections
When a brtpkr member activates a self-exclusion period or requests indefinite self-exclusion, the self-exclusion status is recorded in a dedicated restricted-access database. This record is used to prevent any new account registration from the same individual during the exclusion period and to reject any re-registration attempts using the same CNIC or mobile number. Self-exclusion records are retained for the duration of the exclusion period plus a minimum of five years thereafter to support any regulatory review or re-admission process.
Gaming activity data — including bet frequency, session duration, deposit velocity, and loss patterns — may be processed by brtpkr's responsible gaming monitoring systems to identify members who may be exhibiting signs of problem gambling. This processing is conducted under brtpkr's Gaming License obligation to provide a responsible gaming environment and is not used for marketing or commercial profiling purposes.
17. Changes to This Privacy Policy
brtpkr reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform functionality. Material changes to the Policy will be communicated to registered members via notification on the brtpkr Platform or via SMS to the registered Pakistani mobile number, with a minimum of 14 days' notice before the changes take effect.
The current version of this Privacy Policy, along with its effective date and version number, is always available at brtpkr.net/privacy-policy. Continued use of the brtpkr Platform following the effective date of any updated Policy constitutes acceptance of the updated terms. If you do not agree to the updated Policy, you may request account closure in accordance with brtpkr's Terms & Conditions, available at brtpkr.net/terms-conditions.
18. Contact & Supervisory Authority Complaints
18.1 Privacy Enquiries
All privacy-related enquiries, data rights requests, and complaints relating to brtpkr's data processing practices should be directed to:
Subject Line: "Privacy – [Nature of Enquiry]" for fastest routing to the data protection team
Response Time: Acknowledgement within 5 business days; substantive response within 30 calendar days
Identity Verification: Data rights requests may require verification of your identity before processing
18.2 Supervisory Authority
If you are not satisfied with brtpkr's response to a privacy complaint, you have the right to escalate the complaint to the data protection supervisory authority of the jurisdiction in which brtpkr's Gaming License is issued. brtpkr's support team can provide details of the relevant supervisory authority upon request.
18.3 General Contact
For non-privacy-related enquiries including account support, withdrawal assistance, bonus queries, and responsible gaming tool activation, brtpkr's support team is available 24 hours per day, 7 days per week via the live chat widget on the brtpkr Platform (accessible to logged-in members) and at the email address stated above.