lack33 Privacy Policy

lack33 ("we", "us", "our", "the Platform") is an online gaming and sports betting platform accessible at lack33.com. For the purposes of this Privacy Policy, lack33 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed.

We operate under an international gaming license and are bound by the data protection obligations imposed by that licensing framework. Players based in Pakistan are served through the Platform in accordance with applicable local laws and the terms of our license.

If you have any questions regarding how lack33 processes your personal data, or if you wish to exercise any of your data rights, please refer to Clause 14 for our contact details.

lack33 collects personal data across several categories, each serving a specific and justified operational or legal purpose. The categories of personal data we may collect from you include:

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) unless you voluntarily disclose such information in the context of a responsible gaming self-exclusion or support request, and only to the extent necessary to process that request.

lack33 collects personal data through the following channels and methods:

• Direct submission at registration: When you create an account on lack33, you voluntarily provide identity, contact, and account credential information.
• KYC document upload: When prompted for identity verification, you upload documents such as your Pakistani CNIC, passport, or utility bills. These are processed by our compliance team and, where applicable, a third-party KYC verification provider.
• Financial transactions: When you make a deposit or request a withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, or USDT TRC20, the relevant financial data is captured and stored for transaction processing and regulatory compliance.
• Platform interaction: Your gaming activity, session data, and usage behaviour are automatically recorded as you interact with the platform — this includes game rounds played, bets settled, and pages visited.
• Technical collection: Our servers automatically log technical data including your IP address, device identifiers, and browser metadata each time you access the platform.
• Customer support interactions: Any correspondence submitted via live chat or email is recorded and retained as part of your account history.
• Cookies and similar technologies: As described in Clause 6, we use cookies and tracking technologies to collect usage and session data.

lack33 processes your personal data only where a valid legal basis exists. The table below sets out the primary purposes for which we process your data and the legal grounds on which each processing activity is based:

• Performance of Contract: Processing your registration, verifying your identity, facilitating deposits and withdrawals, and delivering gaming services to your account are all necessary for the performance of the contract between you and lack33.
• Legal Obligation: Anti-money laundering (AML) checks, Know Your Customer (KYC) verification, age verification (21+), and regulatory reporting are carried out because we are legally required to do so under the terms of our international gaming license and applicable financial regulations.
• Legitimate Interests: Fraud detection, platform security monitoring, responsible gaming intervention, product analytics, and customer support quality assurance are carried out on the basis of lack33's legitimate interests in operating a safe and well-functioning platform, provided those interests are not overridden by your fundamental rights.
• Consent: Where we send you optional marketing communications (such as promotional bonus offers or platform news), we do so on the basis of your prior consent. You may withdraw this consent at any time by updating your notification preferences in the account settings or by contacting our support team.

lack33 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual data protection safeguards:

• KYC & Identity Verification Providers: Third-party identity verification partners who assist with document validation, age verification, and fraud screening. All such partners are contractually bound to process data solely for the purpose of providing verification services to lack33.
• Payment Processing Partners: Payment service providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and cryptocurrency processors, who receive only the financial data necessary to process your specific transaction.
• Gaming Software Suppliers: Third-party game studios and live casino providers whose games are integrated into the lack33 platform may receive your player identifier and gaming session data for the purpose of delivering game content and resolving disputes.
• Regulatory & Law Enforcement Authorities: Where required by law, our gaming license conditions, or a lawful order from a competent authority, we may disclose personal data to regulators, law enforcement agencies, tax authorities, or financial intelligence units without prior notice to the player.
• Professional Advisers: Legal counsel, auditors, and compliance consultants who provide professional services to lack33 and who are bound by professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of the lack33 business, your personal data may be transferred to the acquiring entity, subject to the same data protection obligations set out in this Policy.

lack33 uses cookies and similar tracking technologies to enhance platform functionality, maintain session continuity, and gather analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the platform to function correctly. They maintain your login session, remember your account preferences, and ensure secure access to your account. These cookies cannot be disabled without disrupting core platform functionality.
• Analytical / Performance Cookies: These cookies allow us to measure how users interact with the platform — including which pages are visited most frequently, where users encounter errors, and how long sessions last. This data is aggregated and used solely for internal platform improvement purposes.
• Functional Cookies: These cookies remember your preferences, such as language selection, display settings, and responsible gaming tool configurations, so that you do not need to re-enter them on each visit.
• Marketing Cookies: With your consent, we may use cookies to personalise the promotional content displayed to you on the platform based on your gaming activity and interests. You may withdraw consent for marketing cookies at any time via your browser settings or account preferences.

You may manage cookie preferences through your browser's built-in settings. Please note that disabling certain categories of cookies may affect the functionality of the lack33 platform. Instructions for managing cookies are available in the help documentation of all major browsers.

lack33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our legal and regulatory obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulations applicable to gaming operators.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction to satisfy financial record-keeping and tax reporting obligations.
• KYC Documents: Retained for the duration of the account relationship and for five (5) years thereafter. Copies of identity documents are stored in encrypted form and access is restricted to authorised compliance personnel.
• Gaming Activity Logs: Retained for five (5) years to support dispute resolution, regulatory audits, and responsible gaming monitoring.
• Support Communications: Retained for three (3) years from the date of the last interaction to support quality assurance and dispute management.
• Marketing Consent Records: Retained until you withdraw consent and for one (1) year thereafter as evidence of prior consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

lack33 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our technical and organisational measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the lack33 platform is encrypted using industry-standard TLS protocols, ensuring that your login credentials, financial details, and personal information cannot be intercepted in transit.
• Encrypted Data Storage: Sensitive personal data — including KYC documents, financial account details, and identity information — is stored in encrypted databases with strict access controls.
• Two-Factor Authentication (2FA): All player accounts have access to 2FA as an additional layer of login security. We strongly encourage all players to enable 2FA in their account settings.
• Access Controls: Access to personal data within lack33's internal systems is restricted on a role-based basis. Only personnel with a legitimate operational or compliance need can access identifiable player data.
• Regular Security Audits: The platform undergoes periodic penetration testing and third-party security audits to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data breach that poses a risk to player rights, lack33 will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.

As a registered player on the lack33 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our Data Protection team using the details provided in Clause 14:

• Right of Access: You have the right to request a copy of the personal data that lack33 holds about you. We will respond to verified access requests within thirty (30) days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details directly through the account settings dashboard.
• Right to Erasure ("Right to Be Forgotten"): You may request that lack33 delete your personal data. This right is subject to our legal retention obligations — we cannot delete data that we are required to retain by law, such as AML transaction records.
• Right to Restrict Processing: You may request that lack33 temporarily pause the processing of your personal data in certain circumstances, such as where you contest its accuracy or object to our use of it.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to the withdrawal.

lack33 operates a strict 21+ policy. The platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and all accounts are subject to age confirmation before deposit or withdrawal functionality is activated.

If lack33 discovers that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all data associated with the account will be reviewed, and any funds deposited may be withheld pending investigation. The account will subsequently be closed and the data deleted (subject to any legal retention obligations relating to the detection of underage gambling).

If you are a parent or guardian and believe that a minor under your care has created a lack33 account, please contact our support team immediately using the details in Clause 14 so that we can act on your report without delay.

lack33 operates under an international gaming license and may store or process personal data on servers or through service providers located outside Pakistan. Where personal data is transferred to a country that does not offer an equivalent level of data protection, lack33 implements appropriate safeguards to ensure that your data remains protected, including:

• Standard contractual clauses approved by the relevant licensing authority, incorporated into agreements with all third-party data processors located in lower-protection jurisdictions.
• Binding corporate rules or equivalent intra-group transfer mechanisms where data is transferred within the lack33 corporate group across jurisdictions.
• Transfers to jurisdictions that have been assessed as offering an adequate level of data protection by our compliance team and legal advisers.

You may request further information about the specific safeguards in place for any particular international data transfer by contacting our Data Protection team as described in Clause 14.

The lack33 platform may, from time to time, contain links or references to third-party websites, gaming software provider portals, or payment method landing pages. This Privacy Policy applies solely to personal data collected and processed by lack33 itself. Once you navigate away from the lack33 platform to a third-party site or service, lack33 has no control over and accepts no responsibility for the privacy practices of that third party.

We encourage you to review the privacy policies of any third-party platforms you visit, particularly those of your payment service providers (such as JazzCash and EasyPaisa), as their data handling practices may differ materially from those of lack33.

lack33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing obligations. Where material changes are made — meaning changes that significantly affect how we collect, use, or share your personal data — we will provide reasonable notice by:

• Posting an updated version of this Privacy Policy on the lack33 platform with a revised "Last Updated" date prominently displayed at the top of the document.
• Sending a notification to your registered email address where the change is material enough to warrant direct communication.
• Displaying an in-platform banner or notification prompting you to review the updated Policy.

Your continued use of the lack33 platform following the posting of an updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not accept the amended Policy, you must cease using the platform and may request account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which lack33 processes your personal data, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 directly within the platform. Our support team can handle general privacy queries and escalate data rights requests to the compliance team.
• Email: [email protected] — please include "Privacy Request" in the subject line along with your registered username and a clear description of your query or request.

We aim to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within thirty (30) calendar days. Complex requests, such as subject access requests requiring extensive data extraction, may take up to an additional thirty (30) days, in which case we will notify you of the extension and the reason for it.