Privacy Policy — How lock33 Handles Your Data

01 Introduction

lock33 ("lock33", "we", "us", "our") is the operator of the online sports betting and casino platform accessible at lock33.cam. We are committed to protecting the privacy and personal data of every user ("you", "your") who accesses our platform.

This Privacy Policy describes the categories of personal data we collect, the purposes for which that data is processed, the parties with whom it may be shared, the measures we take to protect it, and the rights available to you. This Policy applies to all data processing activities carried out in connection with the lock33 platform, including account registration, identity verification, payment processing, customer support interactions and marketing communications.

By registering an account on lock33, submitting personal data through the platform or continuing to use our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should not register or continue to use the platform.

02 Definitions

The following definitions apply throughout this Privacy Policy:

Personal Data

Any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details and IP address.

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, restriction or deletion.

Data Controller

The entity that determines the purposes and means of processing personal data. For this platform, the Data Controller is lock33.

Data Processor

A third party that processes personal data on behalf of lock33 under a contractual data processing agreement.

KYC

Know Your Customer — the identity and address verification process required by the platform before processing withdrawals or at other compliance trigger points.

Cookie

A small text file stored on your device by a website, used to remember preferences or track usage patterns.

Special Category Data

Particularly sensitive personal data, including health information or biometric data, which attracts higher levels of protection under applicable data protection law.

03 Data Controller

lock33 acts as the Data Controller for all personal data processed in connection with the platform. As Data Controller, lock33 is responsible for ensuring that personal data is collected and processed lawfully, fairly and transparently, and only for the purposes set out in this Policy.

Where lock33 engages third-party service providers to assist with platform operations — such as payment processing, identity verification or customer analytics — those providers act as Data Processors under binding contractual agreements that restrict their use of your data to the specific purposes agreed with lock33.

For all data-related enquiries or rights requests, you may contact lock33 using the contact details set out in Section 15 of this Policy.

04 Personal Data We Collect

lock33 collects personal data through a variety of sources and interactions. The categories of data we collect are described in the table below:

lock33 does not intentionally collect Special Category Data (such as health information or biometric data) in the ordinary course of platform operations. Where users voluntarily disclose health-related information in the context of responsible gambling self-assessment tools, that information is treated with the highest level of confidentiality and is processed only to the extent necessary to fulfil a duty of care.

05 Lawful Basis for Processing

lock33 processes personal data only where a valid lawful basis exists under applicable data protection law. The lawful bases we rely upon are:

• Contractual necessity: Processing that is necessary to perform the contract between you and lock33 — including account creation, transaction processing, KYC verification and customer support.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering obligations, age verification requirements and compliance with court orders or law enforcement requests.
• Legitimate interests: Processing undertaken in pursuit of lock33's legitimate business interests — such as fraud detection, platform security, analytics and service improvement — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit, freely given and withdrawable consent — for example, where you opt in to receive promotional communications. You may withdraw consent at any time by contacting support.

06 How We Use Your Personal Data

lock33 uses the personal data it collects for the following purposes:

• Account management: Creating and maintaining your registered account, verifying your identity, processing login requests and managing account settings.
• Transaction processing: Processing deposits, withdrawals and related financial transactions in PKR and, where applicable, cryptocurrency.
• KYC and compliance: Conducting identity and age verification to comply with anti-money laundering (AML) obligations and platform eligibility requirements.
• Responsible gambling: Monitoring account activity to identify patterns that may indicate problem gambling behaviour, applying self-exclusion requests and implementing deposit, loss and time limits as requested by users.
• Customer support: Responding to enquiries, resolving disputes, processing complaints and communicating account-related information.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, unauthorised account access and other security incidents.
• Platform analytics: Understanding how users interact with lock33 to improve navigation, game availability, payment flows and overall user experience.
• Marketing communications: Sending promotional emails, bonus notifications and event-based communications to users who have opted in to receive such messages. Users may opt out at any time.
• Legal compliance: Maintaining records required by applicable law and responding to lawful requests from competent authorities.

07 Data Sharing & Disclosure

lock33 does not sell, rent or trade your personal data to third parties for their independent marketing purposes. Data is shared only in the following circumstances and only to the extent necessary for the specified purpose:

• Payment processors: Third-party payment service providers involved in processing your deposits and withdrawals. These processors receive only the financial and identity data strictly required to complete the transaction.
• KYC and identity verification providers: Specialist compliance and identity verification services that assist lock33 in fulfilling its age verification and AML obligations.
• Technology and hosting providers: Cloud infrastructure, database hosting and platform technology providers that process data on lock33's behalf under binding data processing agreements.
• Fraud prevention and security services: Third-party services engaged to detect and prevent fraudulent activity, unauthorised access and financial crime.
• Legal and regulatory authorities: Competent law enforcement agencies, regulatory bodies or courts where lock33 is legally required or permitted to disclose information in connection with lawful investigations or proceedings.
• Business transfers: In the event of a merger, acquisition, sale of assets or other corporate restructuring, personal data may be transferred to a successor entity subject to equivalent data protection commitments.

08 Data Retention

lock33 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory and compliance obligations. The following general retention principles apply:

• Active accounts: Personal data associated with an active account is retained for the duration of the account relationship.
• Closed accounts: Following account closure, identity, transaction and KYC records are retained for the minimum period required by applicable AML and financial record-keeping regulations (typically five to seven years depending on jurisdiction).
• Support communications: Customer support records are retained for a period sufficient to resolve disputes and satisfy regulatory obligations, and are thereafter securely deleted.
• Marketing consents: Records of marketing opt-ins and opt-outs are retained for a period sufficient to demonstrate compliance with applicable consent requirements.

When data is no longer required, lock33 will securely delete or anonymise it in accordance with applicable data protection standards.

09 Security Measures

lock33 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• Encryption of data in transit using industry-standard TLS protocols.
• Encryption of sensitive data fields at rest within our databases.
• Access controls restricting internal access to personal data to authorised personnel on a need-to-know basis.
• Two-factor authentication requirements for administrative access to production systems.
• Regular security assessments and vulnerability testing of platform infrastructure.
• Incident response procedures for the identification, containment and notification of data security incidents.

Whilst lock33 takes all reasonable steps to protect your personal data, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying lock33 promptly if you suspect unauthorised access to your account.

10 Cookies & Tracking Technologies

lock33 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies we use are:

• Strictly necessary cookies: Required for the platform to function, including session management, login state maintenance and security tokens. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences such as language settings, display options and previously visited sections of the platform.
• Analytics cookies: Collect aggregated, anonymised data about how users navigate the platform, which pages are visited most frequently and where users encounter errors. This data is used to improve platform performance.
• Session replay tools: Where deployed, these tools record anonymised user interaction patterns (mouse movements, clicks, scroll depth) to identify usability issues. Sensitive fields such as password inputs are excluded from recording.

You can manage cookie preferences through your browser settings. Disabling certain categories of cookie may affect platform functionality — for example, disabling functional cookies may mean your preferences are not remembered between sessions.

11 International Data Transfers

lock33 operates from a jurisdiction outside Pakistan and may transfer personal data to, and process it in, countries other than the country in which you are located. Where personal data is transferred to third-party processors located outside the operator's primary jurisdiction, lock33 ensures that appropriate safeguards are in place — such as contractual data processing agreements incorporating standard data protection clauses — to protect the data to a standard comparable to that required by applicable data protection law.

By using the lock33 platform, you acknowledge and consent to the transfer of your personal data to other jurisdictions as described in this Policy, including for the purposes of identity verification and payment processing.

12 Your Data Rights

Subject to applicable data protection law and any overriding legal obligations, you have the following rights in relation to your personal data held by lock33:

To exercise any of the above rights, please contact lock33 using the details in Section 15. We will acknowledge your request within a reasonable period and aim to respond fully within the timeframe required by applicable law. We may request proof of identity before processing a data rights request.

Please note that certain rights are subject to exemptions where lock33 is required to retain or process data to comply with legal obligations, including AML record-keeping requirements.

13 Minors

lock33 is strictly an adults-only platform. The services are not directed at, and should not be accessed by, any person under the age of 18 years, or the higher minimum age required by the operator's licence jurisdiction, whichever is greater. lock33 does not knowingly collect personal data from minors.

If we become aware that personal data has been collected from a person under the applicable minimum age, that account will be immediately suspended, all associated data will be reviewed and appropriate steps will be taken to delete or restrict the data in accordance with applicable law.

If you believe a minor has registered on the lock33 platform using false age information, please notify us immediately at the contact address in Section 15.

14 Policy Updates

lock33 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law or platform operations. An updated version will be published on this page with a revised Effective Date.

Where changes are material — for example, where we introduce a new category of data processing or a new third-party processor — we will use reasonable endeavours to notify registered users via the email address associated with their account.

Your continued use of the platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how lock33 protects your information.

15 Contact Us

For all privacy-related enquiries, data rights requests or complaints, please contact the lock33 data team using the following details: