Privacy Policy

Pokewin Entertainment Ltd ("we," "us," or "our") operates Packy.gg (the "Platform"), a gamified digital entertainment platform featuring promotional mechanics and virtual item interactions. We are committed to protecting your privacy and personal data in compliance with the General Data Protection Regulation (GDPR), international privacy laws, and applicable data protection regulations. This Privacy Policy outlines how we collect, use, store, share, and protect your personal information when you use our Platform.

1. Data Controller Information

For the purposes of GDPR and other relevant data protection laws, Pokewin Entertainment Ltd, a company registered in Cyprus with registration number HE491188, is the data controller for any personal data collected via the Platform.

Contact Information:

Registered office: Themistokli Dervi 48, 3rd Floor, Flat/Office 306, 1065, Nicosia, Cyprus
Correspondence address: Voukourestiou 25, Neptune House, 1st Floor, Flat/Office 11, Zakaki, 3045, Limassol, Cyprus
Email: [email protected]
Data Protection Officer (DPO): [email protected]

2. Personal Data We Collect

We collect and process the following types of personal data:

Identity Data: Includes your full name, date of birth, nationality, government-issued identification documents (such as a passport, national identity card, or driving licence), biometric (liveness) verification data, proof of residential address, proof of ownership of the payment method used, Source of Funds documentation, and any other information reasonably required for identity verification and regulatory compliance.
Contact Data: Includes your email address, phone number, and physical address.
Financial Data: For payment processing, we may collect information related to payment cards (full card numbers are processed by our payment processors and are not stored by us), digital wallet transactions (such as Apple Pay, Google Pay, or Cash App Pay), billing details, cryptocurrency wallets, transaction history, and deposit/withdrawal details, together with fraud prevention signals associated with your payments.
Technical Data: Includes IP address, browser type, device information, operating system, and usage data (e.g., page interaction, session duration).
User-Generated Content: Any information you provide directly on the Platform, such as chat logs, feedback, or other contributions.
Marketing and Communication Data: Includes your preferences for receiving marketing communications and your communication preferences.

Biometric (liveness) verification data is collected and processed only where necessary to verify your identity as part of the KYC process described below, and is treated as a special category of personal data under Article 9 GDPR.

3. How We Collect Personal Data

We collect personal data directly from you when:

You register for an account on our Platform.
You verify your identity during the Know Your Customer (KYC) process, which is carried out through one or more independent third-party identity verification providers appointed by us from time to time (currently including Sumsub).
You make deposits, withdrawals, or conduct transactions on the Platform.
You participate in games, competitions, promotions, or surveys.
You contact our customer support team.

We may also collect certain data automatically through the use of cookies and similar technologies when you use the Platform (see "Cookies and Similar Technologies" below).

4. Legal Basis for Processing Personal Data

We process your personal data based on the following legal grounds:

Performance of a Contract: To provide you with the services you request, including account registration, deposits, withdrawals, and game participation.
Legal Obligation: To comply with legal requirements, such as anti-money laundering (AML) and know-your-customer (KYC) regulations.
Legitimate Interests:To enhance the Platform's functionality, prevent fraud, secure our network, and provide customer support.
Consent: For marketing communications, where we have requested and obtained your explicit consent.

Where we process special categories of personal data, in particular biometric (liveness) verification data processed for the purpose of uniquely identifying you during the KYC process, we do so on the basis of your explicit consent (Article 9(2)(a) GDPR), which is requested at the point of verification, and, where applicable, on the basis that processing is necessary for reasons of substantial public interest in the prevention of money laundering, terrorist financing, and fraud, in accordance with applicable law. You may decline or withdraw consent to biometric verification; however, where verification is required by law or by this Policy, we may be unable to provide certain services (including redemptions or withdrawals) until your identity has been verified by alternative means acceptable to us.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

Account Registration: To create, verify, and manage your user account.
Transaction Processing: To facilitate purchases, deposits, withdrawals, and in-platform transactions using fiat payment methods (including credit and debit cards, Apple Pay, Google Pay, and Cash App Pay) and cryptocurrency, including payment verification, authorization, refund processing, and chargeback and payment dispute handling.
Compliance: To conduct KYC and AML checks, including identity verification, sanctions screening, and Enhanced Due Diligence where appropriate, in accordance with applicable legal and regulatory obligations and our Anti-Money Laundering Policy.
User Communication: To send you service-related communications, including security alerts, updates, and support responses.
Personalization: To customize and enhance your experience on the Platform based on your preferences and activity.
Marketing: To send you promotional offers and updates about our services, provided you have given us your consent.
Security: To monitor for fraudulent activities, unauthorized access, or other potential security risks.
Analytics:To analyze usage data for improving our Platform's performance and user experience. We may use automated decision-making and profiling to detect fraud, abuse, multi-accounting, or suspicious activity.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal and regulatory obligations. Typically, we keep your data for the duration of your account's existence and for up to five (5) years following account closure, in accordance with AML regulations.

7. Disclosure of Personal Data

We do not sell or trade your personal data to third parties. However, we may share your data with:

Service Providers: Third-party companies that provide services on our behalf, including one or more identity verification providers (currently including Sumsub), payment processors and payment facilitators, fraud prevention providers, and data analysis providers. These providers process personal data only on our behalf and are contractually required to process your data in accordance with our instructions and applicable GDPR requirements.
Payment Ecosystem Participants: In connection with payment processing, verification, fraud prevention, and the handling of chargebacks and payment disputes, relevant transaction and account data may be shared with payment processors, acquiring banks, card networks, card issuers, and digital wallet providers (such as Apple Pay, Google Pay, or Cash App Pay), some of which act as independent controllers of the data they process under their own privacy policies.
Regulatory Authorities: We may disclose personal data to government or regulatory authorities, including the Cyprus Unit for Combating Money Laundering (MOKAS), where required by law for AML, CTF (Counter-Terrorist Financing), or other legal obligations.
Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our assets, your personal data may be transferred to the acquiring entity.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including by our identity verification and payment service providers. When we transfer your data internationally, we ensure appropriate safeguards, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms, to protect your privacy and maintain data security.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right to Access: Request access to your personal data and receive a copy of the information we hold about you.
Right to Rectification: Request correction of any inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data where there is no lawful basis for us to continue processing it.
Right to Restrict Processing: Request restriction of processing under certain circumstances (e.g., if you contest the accuracy of your data).
Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format and transmit that data to another data controller.
Right to Object: Object to the processing of your personal data for direct marketing or legitimate interest purposes.
Right to Withdraw Consent: Withdraw your consent at any time for data processing activities based on consent.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within one month, as required by GDPR.

Certain information, particularly identity verification and compliance records, may need to be retained to satisfy legal or regulatory obligations (including AML record-keeping requirements) and therefore may not be deletable upon request.

10. Cookies and Similar Technologies

We use cookies and similar tracking technologies to collect information about your activity on the Platform. Cookies help us:

Improve user experience by remembering your preferences.
Analyze usage patterns and measure the effectiveness of our content.
Provide targeted advertisements and promotions based on your interests.

You can manage your cookie preferences through your browser settings. For more details, please refer to our Cookie Policy.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or misuse. This includes encryption, firewalls, secure servers, and regular security audits. Despite these efforts, we cannot guarantee absolute security due to the inherent risks associated with online data transmission.

12. Children's Privacy

Our Platform is not intended for individuals under the age of 18 (or the legal age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete that information promptly.

13. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or technological advancements. The updated policy will be posted on this page with the "Last Updated" date. Your continued use of the Platform after any changes signifies your acceptance of the updated policy.

14. Complaints and Contact Information

If you have concerns about our handling of your personal data, you have the right to file a complaint with the supervisory authority in your country. For Cyprus, you may contact the Office of the Commissioner for Personal Data Protection.

If you have questions, comments, or requests regarding this Privacy Policy, please contact our Data Protection Officer:

Email: [email protected]
Address: Voukourestiou 25, Neptune House, 1st Floor, Flat/Office 11, Zakaki, 3045, Limassol, Cyprus

Last Updated: 22 July 2026