Privacy Policy — How clubpl Collects, Uses, and Protects Your Data

Introduction and Identity of the Data Controller

clubpl ("we", "us", "our") operates the online casino and sports betting platform accessible at clubpl.net. As operator of this platform, clubpl acts as the data controller in respect of personal data collected from players, visitors, and users ("you", "your") in connection with the provision of gaming and support services.

clubpl operates under an internationally recognized gaming license. Our data protection practices are mandated and audited as part of the conditions attached to that license. The principles governing our data processing are consistent with internationally recognised data protection frameworks, including purpose limitation, data minimisation, storage limitation, integrity, confidentiality, and accountability.

This Privacy Policy describes in full the categories of personal data we collect, the purposes and legal bases for which we process that data, the parties with whom we may share data, the period for which we retain data, the security measures we apply, and the rights you hold in respect of your personal data. We encourage all clubpl players — particularly those joining from Karachi, Lahore, Islamabad, Faisalabad, and other cities across Pakistan — to read this Policy in full before registering an account.

Where this Privacy Policy uses the phrase "personal data", it refers to any information that relates to, identifies, or could reasonably be used to identify a natural person — directly or indirectly. This includes your name, CNIC number, mobile number, email address, device identifiers, IP address, and financial transaction data.

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Platform" — the clubpl website at clubpl.net, all web-based and mobile gaming interfaces, and all digital services accessible via the same domain.
• "Player" — any individual who has registered, or is attempting to register, a real-money account with clubpl.
• "Visitor" — any person who accesses the Platform without registering or logging in to an account.
• "Account" — the individual, registered player account maintained on the clubpl platform.
• "KYC" — Know Your Customer; the identity and document verification process required before withdrawal functionality is made available.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Third-Party Processor" — a company or individual that processes personal data on clubpl's behalf under a contractual arrangement that binds them to data protection obligations equivalent to those in this Policy.
• "CNIC" — Computerised National Identity Card, issued by the National Database and Registration Authority (NADRA) of Pakistan.

Categories of Personal Data We Collect

The personal data collected by clubpl falls into the following categories, depending on your relationship with the platform:

3.1 Registration and Identity Data

• Full legal name (as it appears on your CNIC);
• Date of birth (for age verification — players must be 21 or older);
• Pakistani mobile number;
• Email address (where provided);
• Residential address;
• CNIC number and copy of CNIC document (collected during KYC);
• Selfie or proof-of-identity photograph (where requested during enhanced KYC).

3.2 Financial and Transaction Data

• JazzCash or EasyPaisa account details (mobile wallet number in the player's name);
• Bank account details (account title, IBAN/account number) where bank transfer is used;
• Deposit history — amounts, dates, payment methods;
• Withdrawal history — amounts, dates, destination payment method;
• Bonus and promotional credit history;
• Source-of-funds documentation (where required for high-value transactions).

3.3 Gaming and Betting Activity Data

• Game session records — games played, bet amounts, outcomes, session duration;
• Sportsbook betting records — events wagered on, odds accepted, stake amounts, settlement outcomes;
• Account balance history;
• Responsible gaming tool usage — limits set, self-exclusion requests, cool-off periods.

3.4 Technical and Device Data

• IP address at time of login and transaction;
• Device type, operating system version, browser type and version;
• Device fingerprint (a technical identifier derived from device characteristics, used for fraud prevention);
• Mobile network operator (e.g., Jazz, Telenor, Zong, Ufone) where identifiable;
• Session logs — login times, logout times, pages accessed.

3.5 Communications Data

• Support chat transcripts and email correspondence between you and the clubpl team;
• Complaint and dispute records;
• Marketing communication preferences and opt-out records.

How We Collect Your Personal Data

clubpl collects personal data through the following channels and mechanisms:

1. Directly from you — information you provide during account registration, KYC document submission, deposit and withdrawal requests, support interactions, or when updating your account details;
2. Automatically through the Platform — technical data collected when you access the Platform, including IP address, device identifiers, session data, and cookies as described in Section 10;
3. Through payment processors — transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK in connection with deposits and withdrawals processed on your account;
4. Through identity verification services — where clubpl engages a third-party KYC verification provider to assist with CNIC verification or enhanced due diligence checks;
5. Through fraud detection systems — technical data generated by clubpl's fraud prevention infrastructure, including device fingerprinting and behavioural analytics applied to account activity.

Purpose of Processing and Legal Basis

clubpl processes personal data only for defined, specified purposes. The table below summarises the primary processing activities, their purposes, and the applicable legal basis for each:

Data Sharing and Third-Party Disclosure

clubpl does not sell, rent, or otherwise make your personal data available to third parties for their own commercial purposes. However, we do share data with certain categories of third parties where necessary to deliver the clubpl service or to comply with legal obligations:

6.1 Payment Service Providers

To process deposits and withdrawals, clubpl shares the minimum necessary financial and identity information with the relevant payment provider — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, or 1LINK. Each of these providers operates under its own regulatory framework and privacy obligations.

6.2 Identity Verification and KYC Providers

Where clubpl uses a third-party service to assist with identity document verification or enhanced due diligence, your CNIC details and associated documentation may be shared with that provider for verification purposes only. Third-party KYC providers engaged by clubpl are bound by data processing agreements that restrict their use of your data to the verification purpose.

6.3 Game Software Providers

The online casino and sportsbook games accessible through the clubpl platform are provided by licensed third-party game software developers. These providers may receive technical identifiers linked to your session to facilitate game delivery and outcome recording. Providers do not receive your full identity or financial data.

6.4 Fraud Prevention and Security Services

clubpl may share technical data — including IP addresses, device fingerprints, and transaction patterns — with specialist fraud prevention services to detect and prevent account abuse, money laundering, and other prohibited activity.

6.5 Regulatory and Law Enforcement Authorities

clubpl will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts when required to do so by law, by the terms of our gaming license, or by a valid court order. Such disclosures are made only to the extent required by the specific legal obligation in question.

International Data Transfers

As an internationally licensed gaming operator, clubpl's data processing infrastructure may involve the transfer of personal data to servers or processors located outside Pakistan. Where such transfers occur, clubpl applies appropriate safeguards to ensure that your data receives a standard of protection equivalent to that described in this Policy.

Safeguards applied to international data transfers include contractual data processing agreements with all recipient entities that impose data protection obligations consistent with our licensing requirements. Where technically feasible, data subject to the highest sensitivity classification — including CNIC data and financial records — is processed within defined geographic boundaries consistent with our compliance framework.

By registering an account with clubpl and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data in the manner described in this section, subject to the safeguards described above.

Data Retention Periods

clubpl retains personal data for no longer than is necessary for the purposes for which it was collected, subject to mandatory retention obligations imposed by our gaming license and applicable legal frameworks. The following general retention guidelines apply:

• Account and Identity Data: Retained for the duration of your active account relationship with clubpl, plus a minimum of 5 years following account closure — as required by anti-money-laundering record-keeping obligations applicable to licensed gaming operators.
• Financial and Transaction Records: Retained for a minimum of 5 years following the date of the transaction, or such longer period as may be required by applicable law or our gaming license conditions.
• KYC Documents: Retained for a minimum of 5 years from the date of submission, or from the date of account closure, whichever is later.
• Gaming Activity Logs: Retained for a minimum of 3 years from the date of the session or bet, as required by gaming license record-keeping obligations.
• Support Communications: Retained for a minimum of 2 years from the date of the interaction, or for such longer period as may be required in connection with an unresolved dispute or regulatory inquiry.
• Marketing Preference Records: Opt-out records are retained indefinitely to ensure compliance with your expressed preferences, even after account closure.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be linked to any identified or identifiable individual.

Security Measures

clubpl applies technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include but are not limited to:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the clubpl platform, ensuring that credentials, payment information, and personal data are never transmitted in readable form over public networks;
• Encryption at rest for all stored personal data, including database records, KYC documents, and financial records;
• Access controls that restrict internal access to personal data on a strict need-to-know basis, enforced through role-based permission systems and activity logging;
• Two-factor authentication available on all player accounts and enforced for internal administrative access;
• Penetration testing and security audits conducted periodically by independent security professionals;
• Anomaly detection systems that identify and alert on unusual account activity patterns indicative of unauthorised access or fraud.

Despite the robust security measures applied by clubpl, no data transmission or storage system can be guaranteed completely secure against all possible threats. In the event of a personal data breach that is likely to result in a high risk to affected individuals, clubpl will notify affected players without undue delay and will take all steps necessary to contain and remediate the incident.

Cookies and Tracking Technologies

The clubpl platform uses cookies and similar tracking technologies to enable core platform functionality, maintain session state, and gather analytics information about how the platform is used. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies maintain your login session, store security tokens, and enable the cashier to function correctly. They cannot be disabled without materially affecting platform functionality.
• Functional Cookies: Store your platform preferences — such as language settings and display options — so that they persist across sessions without requiring you to reconfigure them on each visit.
• Analytics Cookies: Collect aggregated, pseudonymised data about how players use the platform — which pages are most visited, where users encounter errors, and how navigation flows are used. This data is used to improve the platform and is not linked to identifiable individuals.
• Fraud Prevention Cookies: Used as part of clubpl's device fingerprinting and fraud detection infrastructure to identify anomalous activity patterns and protect against multi-accounting.

clubpl does not use third-party advertising cookies or social media tracking pixels. You can manage browser-level cookie settings through your browser's built-in privacy controls. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling other cookie categories will not prevent you from accessing or using the Platform.

Your Data Protection Rights

As a data subject, you hold the following rights in respect of your personal data processed by clubpl. These rights are subject to applicable legal limitations and the specific retention obligations described in Section 8.

To exercise any of the above rights, please contact the clubpl support team via live chat or by email at [email protected]. clubpl will respond to data subject rights requests within 30 days of receiving sufficient information to identify you and process the request. We may require identity verification before fulfilling a rights request to ensure that data is not disclosed to an unauthorised party.

Children's Privacy and Age Restrictions

The clubpl platform is strictly restricted to individuals who are 21 years of age or older. clubpl does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory part of the account registration and KYC process.

If clubpl becomes aware that personal data has been collected from a person under 21 — whether through registration, payment submission, or any other means — that data will be deleted from our systems as quickly as is technically feasible, subject only to any mandatory reporting obligations applicable under our gaming license. Any associated account will be closed and deposits returned via the original payment method where technically possible.

Parents and guardians in Pakistan who believe that a minor in their household may have attempted to register an account with clubpl are encouraged to contact our support team immediately so that the matter can be investigated and resolved without delay.

Responsible Gaming and Personal Data

As part of our responsible gaming obligations under our international gaming license, clubpl processes certain personal data specifically for the purpose of identifying and responding to potentially harmful gambling behaviour. This processing is conducted in the interests of player welfare and forms a non-waivable part of our licensed operation.

Responsible gaming data processing at clubpl includes:

• Monitoring gaming activity patterns for indicators of problem gambling behaviour, such as extended session durations, rapid bet escalation, or repeated deposit activity following losses;
• Recording and enforcing player-initiated deposit limits, session time limits, cool-off periods, and self-exclusion requests;
• Maintaining self-exclusion records for the duration required under our gaming license — typically a minimum of 5 years from the date of the exclusion request;
• Sharing self-exclusion status information with other platforms operating under the same licensing group, where required by our licensing conditions.

Players who have activated self-exclusion on their clubpl account will have their data processed only to the extent necessary to maintain the exclusion and comply with licensing obligations. They will be removed from all marketing communications immediately upon exclusion taking effect. For full details of our responsible gaming tools, please visit the Responsible Gaming page.

Changes to This Privacy Policy

clubpl reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they alter how we collect, use, or share personal data in a way that could significantly affect your privacy interests — we will provide advance notice to registered players via email or an in-platform notification at least 7 days before the updated Policy takes effect.

Minor or administrative updates — such as clarifications of language, correction of typographical errors, or updates to contact information — may be made without advance notice. The "Last Updated" date shown at the top of this page will always reflect when the most recent version of the Policy came into effect.

Your continued use of the clubpl platform following the effective date of any revised Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with an updated Policy, you should discontinue use of the Platform and may request account closure through the clubpl support team.

Contact Information and Data Protection Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how your personal data has been handled by clubpl, please contact us through the following channels:

• Live Chat: Available 24/7 directly from your clubpl account dashboard. This is the fastest channel for data rights requests. Average response time is under 2 minutes.
• Email: [email protected] — mark your email with the subject line "Privacy Request" or "Data Protection Query" for priority routing to the appropriate team member. Responses are provided within 4 hours during normal business hours and within 24 hours at all other times.

Where a player submits a formal data protection complaint and is not satisfied with the response received from clubpl within 28 days, they may escalate the complaint to the relevant data protection supervisory authority or dispute resolution body applicable under clubpl's gaming license jurisdiction.