sltopk Privacy Policy —
How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how sltopk ("the Platform," "we," "us," "our") collects, uses, stores, shares, and protects the personal data of individuals ("Player," "User," "you") who access or use the sltopk online gaming platform, accessible at sltopk.net and all associated mobile-optimised interfaces.

sltopk is committed to processing personal data in a lawful, fair, and transparent manner. This Policy is written to meet the standards expected of a responsibly operated online gaming platform serving Pakistani players and is subject to the data protection and privacy obligations applicable under sltopk's international gaming licence.

This Policy applies to all personal data collected by sltopk in connection with your use of the platform — whether provided directly by you at registration, generated automatically through your use of the Services, or obtained from third-party verification and payment partners in connection with your Account. It does not apply to third-party websites, services, or applications that may be linked to or from the sltopk platform.

For the purposes of applicable data protection law, sltopk is the data controller in respect of personal data collected from Players in connection with the platform. As data controller, sltopk determines the purposes for which, and the means by which, personal data is processed.

Where sltopk engages third-party processors — including payment service providers such as JazzCash and EasyPaisa, KYC verification service providers, game studios, and technical infrastructure providers — those parties process personal data strictly on sltopk's behalf and under binding contractual obligations that prohibit any use of that data for the processor's own purposes.

Queries regarding sltopk's role as data controller, or regarding the identity of any sub-processors engaged by sltopk, may be directed to the support team at the contact details provided in Section 15 of this Policy.

sltopk collects personal data across the following categories. The Data At a Glance table above provides a structured summary; this section provides additional context:

Identity and Contact Data is collected at the point of Account registration. This includes your full legal name, date of birth, CNIC number, mobile phone number, email address, and city of residence. This data is essential for creating your Account, verifying your identity, and fulfilling sltopk's age verification obligations. Without this data, sltopk cannot open or maintain an Account for you.

Financial and Payment Data is collected when you make a deposit or request a withdrawal. This includes the JazzCash or EasyPaisa mobile account number, or bank account details, associated with your transaction. For compliance with anti-money laundering obligations, sltopk also records the complete transaction history of your Account, including all deposits, withdrawals, wagers, and bonus credits. sltopk does not store full card numbers or full bank account numbers — only the minimum information necessary to facilitate and verify transactions.

KYC Documentation is collected when sltopk requests identity verification, either at Account registration or at the point of a withdrawal request. This may include scanned copies or photographs of your CNIC or passport, proof of your JazzCash or EasyPaisa account, and — in cases of enhanced due diligence — documentation evidencing your source of funds. This documentation is stored securely and accessed only by authorised compliance personnel.

Gaming Activity and Technical Data is generated automatically as you use the sltopk platform. This includes the games you play, the bets you place, your session durations, your win and loss history, and technical identifiers including your IP address, device type, browser type, and approximate geographic location. This data is used to deliver the Services, detect fraud, monitor responsible gaming indicators, and improve the platform.

sltopk collects personal data through three primary mechanisms:

• Direct provision by you: Data you enter into the sltopk platform — including registration forms, KYC document uploads, support communications, and marketing preference settings;
• Automated collection: Data generated automatically as you use the platform — including session logs, gaming activity records, device fingerprints, and IP address logs collected through cookies, server logs, and similar tracking technologies (see Section 10);
• Third-party sources: Data received from payment service providers (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) in connection with deposit and withdrawal processing; data received from KYC and identity verification service providers; and data received from fraud prevention partners where sltopk has a legitimate interest in cross-referencing account information against known fraud indicators.

sltopk does not purchase personal data from data brokers or other commercial data aggregators. All data collected by sltopk originates from interactions with the platform or from regulated third-party service providers with a direct functional relationship to your Account.

sltopk processes personal data only where a lawful basis exists. The primary purposes and corresponding legal bases are as follows:

• Contract Performance: Processing your identity, contact, financial, and gaming activity data is necessary to operate your sltopk Account and deliver the Services you have contracted to receive. Without this processing, sltopk cannot fulfil its contractual obligations to you.
• Legal and Regulatory Compliance: sltopk is required by its international gaming licence and applicable anti-money laundering obligations to conduct KYC verification, retain transaction records, monitor gaming activity for responsible gaming indicators, and report suspicious activity. Processing in this context is necessary for compliance with legal obligations and cannot be refused.
• Legitimate Interests: sltopk processes technical and gaming activity data to detect and prevent fraud, protect the security of the platform, and improve the overall user experience. These interests have been assessed as legitimate and proportionate to the data processing involved.
• Consent: Where sltopk sends marketing communications or uses cookies for analytical and advertising purposes beyond the strictly necessary minimum, this processing is based on your freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

sltopk may share your personal data with the following categories of third parties, strictly for the purposes described:

• Payment Service Providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processing partners receive the minimum transactional data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable financial regulations.
• KYC and Identity Verification Providers: Third-party verification services engaged by sltopk receive a copy of your identity documents solely for the purpose of verifying your identity and age. These providers are contractually prohibited from using your data for any other purpose.
• Game Studio Providers: Where games are delivered by third-party studios integrated into the sltopk platform, those studios may receive technical session data (such as Player ID and session token) necessary to deliver the game. They do not receive your personal identity or financial data.
• Fraud Prevention and Security Partners: sltopk may share technical identifiers (including IP address and device fingerprint) with specialist fraud detection services to identify and prevent fraudulent Account activity.
• Regulatory and Law Enforcement Authorities: sltopk will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or regulatory direction.
• Professional Advisers: Lawyers, auditors, and insurers engaged by sltopk may access personal data on a strictly confidential, need-to-know basis in connection with the provision of professional services.

sltopk operates as an internationally licensed online gaming platform, and certain of its infrastructure, service providers, and game studios are located outside Pakistan. Your personal data may therefore be transferred to and processed in countries other than Pakistan in connection with the delivery of sltopk's Services.

Where personal data is transferred internationally, sltopk ensures that appropriate safeguards are in place to protect that data to a standard equivalent to that applied within the platform. These safeguards include:

• Contractual data protection clauses binding the receiving party to processing standards consistent with this Policy;
• Transfers only to service providers in jurisdictions with recognised data protection frameworks;
• Encryption of data in transit and at rest for all cross-border transfers.

Players who wish to obtain further information regarding the safeguards applicable to specific international transfers of their personal data may request this information from sltopk's support team.

sltopk retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to overriding legal and regulatory retention obligations. The following retention periods apply as a general guide:

• Account Registration Data: Retained for the duration of the active Account and for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping obligations;
• KYC Documentation: Retained for a minimum of five (5) years following the completion of KYC verification, in accordance with applicable regulatory requirements;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with anti-money laundering obligations;
• Gaming Activity Data: Retained for the duration of the active Account and for two (2) years following Account closure, for responsible gaming monitoring and dispute resolution purposes;
• Technical and Session Data: Retained for thirteen (13) months from the date of collection for fraud detection and platform improvement purposes;
• Marketing Preference Data: Retained until you withdraw consent or update your preferences, plus a reasonable period to process the update.

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised so that it can no longer be associated with any identifiable individual.

sltopk implements a multi-layered approach to personal data security that is designed to protect against unauthorised access, accidental loss, destruction, or disclosure. The following technical and organisational measures are in place:

• Encryption: All data transmitted between your device and the sltopk platform is encrypted using 256-bit SSL/TLS protocols. Personal data stored on sltopk's servers is encrypted at rest;
• Access Controls: Access to personal data is restricted to authorised sltopk personnel whose roles require such access. All access is subject to role-based permissions and is logged for audit purposes;
• Two-Factor Authentication: sltopk offers and encourages Players to enable two-factor authentication on their Accounts. Internal system access by sltopk personnel is protected by mandatory multi-factor authentication;
• Penetration Testing: The sltopk platform is subject to regular independent security testing to identify and remediate potential vulnerabilities;
• Incident Response: sltopk maintains a documented personal data breach response procedure. In the event of a breach that poses a risk to your rights, sltopk will notify affected individuals without undue delay.

sltopk uses cookies and similar tracking technologies on its platform. Cookies are small text files placed on your device that allow the platform to recognise your browser and store certain information across sessions. sltopk uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the sltopk platform to function. They maintain your session when you are logged in, remember your game state, and enable security features. These cookies cannot be disabled without rendering the platform non-functional.
• Functional Cookies: These cookies remember your preferences — such as your chosen language and display settings — to personalise your experience on sltopk. They can be disabled, though doing so may reduce platform functionality.
• Analytical Cookies: sltopk uses analytical cookies to understand how Players interact with the platform — including which sections are most visited, where Players spend the most time, and where errors occur. This data is used in aggregate to improve the platform and is not used to identify individual Players without their consent.
• Responsible Gaming Cookies: Certain cookies are used specifically to track session duration and to trigger responsible gaming reminders where Players have set session time limits on their Accounts. These cookies support player protection functionality.

Players can manage cookie preferences through their browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to and using the sltopk platform.

Subject to applicable legal limitations, you hold the following rights in respect of your personal data processed by sltopk:

• Right of Access: You may request a copy of all personal data held about you by sltopk, along with information about how it is being processed;
• Right of Rectification: You may request that sltopk correct any inaccurate or incomplete personal data held about you;
• Right to Erasure: In certain circumstances — including where data is no longer necessary for the purposes for which it was collected — you may request deletion of your personal data. Note that this right is subject to overriding legal retention obligations, particularly those arising from sltopk's anti-money laundering compliance requirements;
• Right to Restrict Processing: You may request that sltopk restrict the processing of your personal data while the accuracy of the data is being contested, or while you object to processing based on legitimate interests;
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request that sltopk provide your personal data in a structured, machine-readable format;
• Right to Object: You may object to processing based on legitimate interests, including profiling for marketing purposes. You may also object to direct marketing at any time;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Requests to exercise any of these rights should be directed to sltopk's support team. sltopk will respond to all valid requests within thirty (30) days. In complex cases, this period may be extended by a further two months, in which case sltopk will notify you of the extension and the reasons for it.

sltopk employs mandatory age verification at the Account registration stage and requires KYC documentation confirming that Players are aged 21 or above before any withdrawal is processed. These measures are designed to prevent minors from accessing the platform and from having their personal data collected in connection with it.

If you have reason to believe that a minor has registered an Account on sltopk, please contact our support team immediately at the details in Section 15. sltopk takes all such reports seriously and will investigate and act promptly.

sltopk may send you promotional communications — including information about new games, upcoming cricket betting events such as PSL matches, bonus offers, and platform updates — where you have provided your consent to receive such communications at registration or subsequently through your Account preferences.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your sltopk Account settings;
• Using the unsubscribe link included in any marketing email sent by sltopk;
• Contacting sltopk's support team via live chat or email and requesting removal from marketing communications.

Withdrawal of marketing consent will not affect the delivery of transactional communications — including deposit confirmations, withdrawal notifications, KYC requests, and responsible gaming alerts — which are sent as part of sltopk's contractual and regulatory obligations regardless of marketing preferences.

sltopk reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, platform operations, or data processing practices. The current operative version of this Policy is always the version bearing the most recent "Last Revised" date displayed at the top of this page.

Where changes to this Policy are material — meaning they significantly affect how your personal data is processed or the rights available to you — sltopk will provide advance notice via the registered email address on your Account or through a prominent notice on the platform, no less than fourteen (14) days before the changes take effect. For non-material changes, the updated Policy will take effect upon publication without prior notice.

Continued use of the sltopk platform following the publication of an amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the amended Policy, you should cease use of the platform and may request Account closure by contacting sltopk support.

If you have questions, concerns, or requests relating to this Privacy Policy or sltopk's handling of your personal data, please contact our team through any of the following channels. All privacy-related requests will be handled by designated personnel with responsibility for data protection matters.

• Live Chat: Available 24 hours a day, 7 days a week, from within your logged-in sltopk Account. This is the fastest channel for urgent privacy concerns, including suspected data breaches or unauthorised Account access.
• Email: [email protected] — for formal data subject access requests, rectification requests, deletion requests, and detailed privacy queries. Please mark the subject line of your email "Privacy Request" to ensure prompt routing to the appropriate team.
• FAQ: Common questions about sltopk's data practices are addressed in our FAQ section.

sltopk targets an initial acknowledgement of all privacy requests within forty-eight (48) hours and a substantive response within thirty (30) calendar days. Complex requests may require additional time, in which case sltopk will notify you of the anticipated timeline.