Privacy Policy – How mgpk Handles Your Personal Data

mgpk ("we", "us", "our") operates the informational website accessible at https://mgpk.cam (the "Platform"). We are committed to protecting the personal data of every individual who visits, browses or interacts with the Platform, including our users across Pakistan — from Karachi and Lahore to Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar.

This Privacy Policy ("Policy") sets out in clear, plain English:

• What categories of personal data mgpk collects;
• The purposes for which that data is processed;
• The legal bases on which we rely to process your data;
• How long we retain personal data and the security measures we apply;
• The rights available to you as a data subject and how to exercise them;
• How to contact us with any privacy-related queries or requests.

Please read this Policy carefully. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with our data practices as described, please discontinue your use of the Platform.

mgpk acts as the Data Controller for personal data collected through the Platform at https://mgpk.cam. As Data Controller, we are responsible for ensuring that personal data is processed lawfully, fairly and transparently, and only for the purposes described in this Policy.

For any data protection enquiries, requests to exercise your rights, or concerns about our data practices, please contact us using the details provided in Section 18 of this Policy.

The categories of personal data we collect depend on how you interact with the Platform. The following table summarizes the data categories and their context:

We do not intentionally collect special categories of sensitive personal data (such as health data, biometric data beyond identity verification purposes, political opinions, religious beliefs or financial account numbers) unless strictly required for a specific compliance purpose, in which case we will seek your explicit consent.

We collect personal data through the following methods:

5.1 Direct Collection

Data you provide to us voluntarily when you: create or update a Platform account; complete an identity verification (KYC) request; contact our support team by email; or submit any feedback or enquiry through the Platform. All form fields visible on the Platform are available in English, with labels and placeholders in English (e.g., "Email Address", "Username", "Message").

5.2 Automated Collection

When you access the Platform, certain technical and usage data is collected automatically through server logs, cookies and analytics technologies. This includes your IP address, the pages you visit, the order in which you navigate the Platform, the device and browser you are using, and approximate geographic location derived from IP address.

5.3 Third-Party Sources

In limited circumstances, we may receive data from third-party identity verification service providers used in our KYC process. We do not purchase personal data from data brokers or marketing lists.

We process your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms and Conditions of the Platform, including account management and support services;
• Legitimate interests: Processing necessary for our legitimate business interests, such as platform security, fraud prevention, analytics to improve the Platform, and ensuring the technical operation of the website — provided these interests are not overridden by your fundamental rights;
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering requirements, identity verification obligations and responding to lawful requests from competent authorities;
• Consent: Where we rely on your consent as the legal basis — for example, for certain non-essential cookies or marketing communications — you may withdraw your consent at any time without prejudice to the lawfulness of processing carried out before withdrawal.

mgpk uses the personal data we collect for the following purposes:

• Account administration: Creating, maintaining and managing your registered Platform account, including processing identity verification where applicable;
• Platform operation and improvement: Analysing usage patterns to improve navigation, content relevance and the overall user experience — particularly for Pakistani users accessing content about PSL betting, casino games and payment method guidance;
• Security and fraud prevention: Detecting and preventing fraudulent account activity, unauthorized access attempts and other security threats to the Platform;
• Customer support: Responding to your queries, complaints and support requests submitted via email or the Platform contact channels;
• Legal compliance: Fulfilling obligations under applicable law, including responding to lawful requests from regulatory authorities or courts of competent jurisdiction;
• Communications: Sending you service-related notices, policy updates or responses to your enquiries. We do not send unsolicited marketing communications without your prior consent;
• Analytics: Generating aggregated, anonymised statistical insights about Platform usage to inform content strategy. These reports do not identify individual users.

We will not use your personal data for any purpose that is incompatible with the purposes described above without first notifying you and, where required, obtaining your consent.

mgpk uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit our website. They allow us to recognize your device on return visits and maintain session continuity.

8.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function correctly. These cannot be disabled without impacting core functionality. No consent is required for these cookies;
• Performance and analytics cookies: Used to understand how visitors interact with the Platform — such as which pages are most visited and how users navigate between sections. Data collected is aggregated and anonymised where possible;
• Functionality cookies: Remember your preferences (such as language settings or display choices) to provide a more personalized experience;
• Session cookies: Temporary cookies deleted when you close your browser, used to maintain your login state and session integrity.

8.2 Managing Cookies

You can control and delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform. Most modern browsers allow you to refuse new cookies, delete existing cookies and set preferences for specific websites. Please consult your browser's help documentation for instructions.

mgpk does not sell, rent or trade your personal data to third parties for commercial purposes. We may share personal data in the following limited circumstances:

9.1 Service Providers (Data Processors)

We may engage trusted third-party service providers who process data on our behalf under contractual data processing agreements. These may include cloud hosting providers, analytics platforms, identity verification service providers and customer support tooling. All such providers are bound by confidentiality obligations and may only process data for the specific purpose for which they were engaged.

9.2 Legal and Regulatory Requirements

We may disclose personal data to law enforcement agencies, regulatory authorities, courts or other government bodies where we are legally required to do so, where we have a good-faith belief that disclosure is necessary to protect the rights or safety of any individual, or where required to prevent or investigate fraud or other unlawful activity.

9.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of our business assets, personal data held by mgpk may be transferred to the acquiring entity as part of that transaction. We will notify affected users of any such transfer by updating this Policy.

9.4 No Sale of Data

The Platform may be hosted on servers located outside Pakistan. When you access mgpk, your personal data may be transferred to and processed in countries that have different data protection standards from those applicable in Pakistan.

Where such transfers occur, we take appropriate safeguards to ensure your data receives a level of protection consistent with international best practices. These safeguards may include contractual clauses that oblige the recipient to protect personal data to equivalent standards, or reliance on service providers operating in jurisdictions recognized as providing adequate data protection.

By using the Platform from Pakistan or any other jurisdiction, you acknowledge that your data may be transferred internationally as described in this section.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal obligations. Our general retention principles are as follows:

• Account data: Retained for the duration of your registered account and for a reasonable period thereafter to enable dispute resolution and comply with regulatory obligations;
• KYC and identity verification data: Retained for the period required by applicable anti-money laundering regulations, which may extend beyond account closure;
• Technical and usage data: Typically retained in aggregated or anonymised form for analytics purposes following an appropriate anonymisation period;
• Support communications: Retained for a period sufficient to resolve the relevant enquiry and provide records in case of follow-up, generally not exceeding three years unless a dispute requires longer retention;
• Cookie data: Session cookies expire when you close your browser; persistent analytics cookies expire in accordance with the settings of the relevant analytics tool, typically between 13 and 26 months.

When data is no longer required, we will securely delete, anonymise or destroy it in accordance with our data disposal procedures.

mgpk implements appropriate technical and organizational security measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure or destruction. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between your device and our servers;
• Access controls limiting personal data access to authorized personnel only, on a need-to-know basis;
• Regular security assessments of our hosting infrastructure and Platform code;
• Secure document handling procedures for KYC materials submitted by Users;
• Incident response procedures for identifying, containing and reporting data breaches where legally required.

No method of transmission over the internet or electronic storage is 100% secure. While we apply industry-standard safeguards, we cannot guarantee absolute security. If you believe your account security has been compromised, please contact us immediately at the address in Section 18.

Subject to applicable law, you have the following rights in respect of your personal data held by mgpk. To exercise any of these rights, please contact us using the details in Section 18. We will respond within a reasonable timeframe and in any event within the period required by applicable data protection law.

We may request proof of identity before processing any rights request to ensure we are responding to the correct individual and protecting your data from unauthorized disclosure.

The Platform is strictly intended for individuals who are 18 years of age or older — or the higher minimum age required by the applicable operator's license jurisdiction. mgpk does not knowingly collect personal data from individuals under 18 years of age.

If you are a parent or guardian and believe your child has provided personal data to mgpk, please contact us immediately at the details in Section 18 so we can take appropriate action.

The Platform may contain informational references to Third-Party Operators — online casinos, sportsbooks and associated services. Any interaction you have with a Third-Party Operator is governed by that operator's own privacy policy and terms of use. mgpk has no control over, and accepts no responsibility for, the privacy practices or data security standards of any Third-Party Operator.

We strongly recommend that you review the privacy policy of any Third-Party Operator before registering, depositing funds or providing personal data to them. This is particularly important for Pakistani users given the range of international operators that may be referenced on mgpk — their data practices, retention periods and user rights mechanisms will differ from those described in this Policy.

Payment providers mentioned on mgpk — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are independent entities with their own privacy policies and data governance frameworks. Their names appear on mgpk as familiar Pakistani payment context only. They are not associated with this Platform's data processing activities.

mgpk serves a predominantly Pakistani audience. While Pakistan does not currently have a comprehensive standalone data protection law equivalent to international frameworks such as the GDPR, the Protection of Personal Information is addressed in part through instruments including:

• The Prevention of Electronic Crimes Act, 2016 (PECA), which addresses unauthorized data access and electronic crimes;
• The Pakistan Telecommunication (Re-organization) Act, 1996;
• Draft Personal Data Protection Bill (subject to ongoing legislative process at the time of this Policy's publication).

mgpk voluntarily applies privacy-by-design principles consistent with internationally recognized data protection standards, including data minimization, purpose limitation, storage limitation, integrity and confidentiality. We do this because we believe it is the right approach for serving Pakistani users, regardless of mandatory legal requirements.

mgpk reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the Policy, we will publish the revised version on this page with an updated effective date. Where we consider the changes to be significant, we will endeavour to provide reasonable advance notice to registered Users.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of those changes. If you do not agree with any amendment, please discontinue your use of the Platform and, if applicable, close your account by contacting us at the details below.

We recommend that you review this Policy periodically to stay informed about how mgpk handles your personal data.

If you have any questions, concerns or requests relating to this Privacy Policy or your personal data held by mgpk, please contact our privacy team using the details below. All communications should be in English. We aim to acknowledge all enquiries promptly and resolve substantive requests within the timeframe required by applicable law.

When submitting a data subject rights request, please include sufficient information to allow us to verify your identity and locate your data. We may request additional identification before processing your request to protect your data from unauthorized disclosure.