Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by Wapak ("we", "us", "our") and applies to personal data collected through our website at https://wapak.cam ("the Platform") and through any related services, communications or interactions with users of the Platform.

We take the protection of personal data seriously. This Policy is intended to give you a clear and transparent account of how your information is handled — what is collected, why, by whom, for how long, and what choices and rights are available to you.

By accessing the Platform, registering an Account, or otherwise providing personal information to wapak, you acknowledge that you have read and understood this Policy. Where your use of the Platform involves providing personal data, you consent to its processing as described herein, unless you indicate otherwise through the mechanisms described in Section 12.

2 Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, ID number, location data, online identifier or one or more factors specific to that person.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Wapak is the data controller in respect of data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of the data controller under a contractual obligation and subject to data protection requirements.
• "User" / "Data Subject" — any individual whose personal data is processed by Wapak in connection with their access to or use of the Platform.
• "Cookies" — small text files placed on your device by a web server when you visit the Platform, used to remember preferences, session state and analytical information.
• "KYC" (Know Your Customer) — the identity verification process through which users submit identity documents to confirm their identity and eligibility to use the Platform.
• "Applicable Data Protection Law" — the data protection laws and regulations applicable in the operator's license jurisdiction and, where relevant, any applicable law in the user's own jurisdiction.

3 Data Controller

For personal data collected through the Platform, Wapak acts as the data controller. The Platform operates under the laws of the operator's license jurisdiction. Wapak is not regulated by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA) or the State Bank of Pakistan, and does not claim to be subject to Pakistani data protection or privacy legislation as a primary governing law.

Users in Pakistan who have concerns about the cross-border transfer of their data should be aware that their personal data may be processed and stored outside Pakistan, in the operator's hosting and processing infrastructure jurisdiction. By using the Platform, Pakistani users acknowledge and accept this international data transfer as described in Section 10 of this Policy.

4 Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with the Platform:

We do not intentionally collect sensitive personal data (such as health information, religious beliefs, biometric data or political opinions) unless it is directly relevant to a responsible gambling assessment or a legally required KYC process. Where such data is collected, explicit consent will be sought.

5 How We Collect Personal Data

Wapak collects personal data through the following channels and mechanisms:

• Direct Provision: Data you provide actively when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or subscribing to promotional communications.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser information and session data via server logs and analytics technologies.
• Cookies and Tracking Technologies: Data collected via cookies and similar technologies placed on your device when you visit the Platform, as described in Section 8.
• Third-Party Sources: Data received from identity verification providers, fraud-prevention services, payment processors and, where applicable, publicly available sources — used to validate the accuracy of information you have provided or to fulfil our legal obligations.
• Inferred Data: Data inferred or derived from analysis of your Platform usage, such as preferred content categories, session patterns or risk indicators used for responsible gambling monitoring.

6 Legal Basis for Processing

We process personal data only where a valid legal basis exists under applicable data protection law. The legal bases we rely on are set out below:

• Performance of a Contract: Processing necessary to register and manage your Account, process deposits and withdrawals, verify your identity and provide access to Platform features.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), KYC and responsible gambling regulations imposed by the operator's license jurisdiction.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform analytics, improving user experience and detecting platform abuse — where our legitimate interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications, non-essential cookies and any processing activity where consent is the appropriate basis. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

7 Data Processing — How We Use Your Data

Personal data collected by Wapak is processed for the following purposes, limited to what is necessary for each stated purpose:

• Account Management: Creating, maintaining and securing your Account; processing login sessions; updating account preferences; managing responsible gambling settings such as deposit limits and self-exclusion.
• Identity & Compliance Verification: Conducting KYC checks in compliance with AML/CTF obligations; verifying age eligibility (18+ or higher as required); screening against sanctions and prohibited-person lists.
• Transaction Processing: Processing deposits, withdrawals and promotional credit applications in PKR; maintaining financial records; detecting and investigating suspicious transactions.
• Customer Support: Handling queries submitted via live chat, help centre or email; maintaining records of support interactions for quality and dispute-resolution purposes.
• Responsible Gambling Monitoring: Monitoring usage patterns to identify indicators of problem gambling; triggering responsible gambling interventions; maintaining self-exclusion records.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, account abuse, bonus exploitation and other prohibited conduct; maintaining security logs; reporting to authorities where legally required.
• Platform Improvement: Analysing aggregated usage data to improve Platform performance, content quality, navigation and user experience. Aggregated analytics do not identify individual users.
• Marketing Communications: Sending promotional offers, bonus notifications and platform updates to users who have opted in to receive such communications. Opt-out is available at any time.
• Legal Compliance: Fulfilling recordkeeping, reporting and disclosure obligations imposed by the operator's license jurisdiction and any other applicable law.

8 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies (collectively, "cookies") to support core platform functionality, remember your preferences, measure usage patterns and improve your experience. A brief explanation of each cookie category is provided below:

• Strictly Necessary Cookies: Required for basic Platform functionality, including session management, login state, security tokens and CSRF protection. These cannot be disabled without impacting Platform usability.
• Functional Cookies: Used to remember user preferences such as language settings, account configuration and display options. Disabling these may reduce personalisation of the Platform experience.
• Analytics Cookies: Used to collect aggregated data on how visitors use the Platform — pages visited, session duration, error events and navigation paths. This data is processed in anonymised or pseudonymised form to improve Platform performance.
• Marketing and Preference Cookies: Where you have opted in, these cookies are used to tailor promotional content and measure the effectiveness of marketing campaigns. They are not placed without your consent.

You may manage your cookie preferences through your browser settings. Most browsers allow you to refuse, delete or be notified of cookies. Note that refusing cookies may affect the functionality of certain Platform features. Instructions for managing cookies are available through your specific browser's help documentation.

Wapak does not use cookies to collect sensitive personal data, financial information or data that could be used to identify you in a context unrelated to your use of the Platform.

9 Third-Party Data Sharing

Wapak does not sell, rent or trade your personal data to third parties for their own marketing purposes. We share personal data with third parties only in the circumstances described below:

• Identity Verification Providers: KYC and AML compliance providers who process identity documents and perform checks on our behalf, subject to data processing agreements.
• Payment Processors: Entities that facilitate deposit and withdrawal transactions. Data shared is limited to what is necessary to process the transaction. References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on this Platform are for context only; data is shared only with processors that are active in the live cashier and subject to contract.
• Fraud Prevention and Security Services: Third-party services used to detect fraud, identify account abuse and protect platform security. These providers process data as data processors under our instruction.
• Analytics Providers: Providers of aggregated, anonymised analytics services used to understand Platform usage. No individually identifying data is shared with analytics providers where they operate as independent data controllers.
• Legal and Regulatory Authorities: Competent authorities, regulators, courts or law enforcement bodies where disclosure is required by applicable law, a court order or a regulatory obligation in the operator's license jurisdiction.
• Business Transfers: In the event of a merger, acquisition, asset sale or restructuring involving Wapak, personal data may be transferred to the successor entity. Users will be notified if their data becomes subject to a materially different privacy policy as a result.

All third parties with whom we share personal data are required to handle it in accordance with applicable data protection standards and are prohibited from using it for purposes beyond those for which it was shared.

10 International Data Transfers

Wapak's Platform infrastructure and service providers may be located in jurisdictions outside Pakistan. Personal data collected through the Platform may therefore be transferred to, stored in and processed in countries other than Pakistan. These countries may not have data protection laws equivalent to those of Pakistan or the European Union.

Where personal data is transferred internationally, we take appropriate steps to ensure that it receives an adequate level of protection, including through:

• Contractual safeguards with data processors, including standard contractual clauses or equivalent data transfer mechanisms where applicable;
• Restrictions on the purposes for which transferred data may be used; and
• Obligations on processors to implement appropriate technical and organisational security measures.

11 Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected, and in accordance with our legal obligations. The following general retention principles apply:

• Active Accounts: Personal data associated with an active Account is retained for the duration of the Account's existence and for a period following Account closure, as required by AML/CTF regulations, licensing requirements and financial recordkeeping obligations in the operator's license jurisdiction. Regulatory retention periods typically range from five to seven years following Account closure.
• KYC Documents: Identity and verification documents are retained for the minimum period required by applicable AML/CTF regulations, which in most jurisdictions is a minimum of five years from the date of the relevant transaction or the end of the business relationship, whichever is later.
• Transaction Records: Financial transaction records (deposits, withdrawals, bonus transactions) are retained in line with financial reporting obligations — typically five to seven years.
• Support Communications: Records of customer support interactions are retained for a period of up to three years from the date of the interaction, for dispute resolution and service quality purposes.
• Marketing Data: Where processing is based on consent, marketing preference data is retained until consent is withdrawn. Upon withdrawal of consent, you will be removed from marketing communications promptly.
• Technical and Log Data: Server logs, session data and technical access records are retained for up to 12 months unless a longer period is required for security investigations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

12 Your Rights as a Data Subject

Subject to applicable data protection law and any exceptions that may apply (such as legal hold obligations or ongoing investigations), you have the following rights in respect of your personal data:

To exercise any of the above rights, submit a request to the support contact address set out in Section 16. We will respond within the timeframe required by applicable law — typically within one calendar month. We may request verification of your identity before processing a rights request to protect against unauthorised access.

13 Data Security

Wapak implements appropriate technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• Encryption of data in transit using industry-standard TLS (Transport Layer Security) protocols;
• Encryption of sensitive data at rest, including stored passwords (which are hashed and salted using appropriate cryptographic methods) and identity document stores;
• Access controls limiting data access to authorised personnel on a need-to-know basis, with role-based permissions and audit logging;
• Regular security assessments, penetration testing and vulnerability scanning of Platform infrastructure;
• Incident response procedures for detecting, containing and reporting data breaches, including notification obligations under applicable law;
• Staff training on data protection obligations and secure data handling practices.

While we apply rigorous security measures, no internet transmission or electronic storage system is entirely secure. We cannot guarantee the absolute security of data transmitted to or stored on the Platform. Users are encouraged to use strong, unique passwords for their Accounts and to notify us immediately if they suspect any unauthorised access.

14 Children's Privacy

The Platform is strictly intended for adults aged 18 years or older, or the higher minimum age required by the applicable operator license jurisdiction. We do not knowingly collect personal data from individuals below the applicable minimum age.

If we become aware that personal data has been collected from a person below the applicable minimum age, we will take immediate steps to delete that data and close the associated Account. If you are a parent or guardian and believe that a minor has registered on the Platform or provided personal data to us, please contact us as described in Section 16.

Age verification checks are conducted as part of the KYC process. Any Account identified as belonging to an underage individual will be suspended immediately and balances will be handled in accordance with applicable law and operator policy.

15 Amendments to This Policy

Wapak reserves the right to amend, update or replace this Privacy Policy at any time, at its sole discretion. Any changes will take effect upon publication of the revised Policy on the Platform, unless a later effective date is specified. The "Effective Date" at the top of this page reflects the date of the most recent revision.

We encourage you to review this Policy periodically to remain informed of how we handle your personal data. Where an amendment materially affects your rights or how your data is processed, we will take reasonable steps to notify you through available communication channels prior to the change taking effect.

Your continued use of the Platform following any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with any amendment, you should discontinue use of the Platform and may request Account closure as described in our Terms & Conditions.

16 Contact Us

For all privacy-related enquiries, data subject rights requests, consent withdrawals or complaints regarding our data handling practices, please contact the Wapak data handling team through the following channel:

We aim to acknowledge all privacy-related requests within five business days and to resolve them within one calendar month of receipt. Where a request is complex or high in volume, we may extend this period by a further two months, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in the operator's license jurisdiction. Details of that authority are available on request.