r888 Privacy Policy — How We Protect Your Personal Data in Pakistan

1. Who We Are — The Data Controller

r888 ("r888", "we", "us") operates the online gaming and sports betting platform accessible at r888.world. For the purposes of data protection, r888 acts as the data controller in respect of personal information collected from Pakistani players through the platform.

As data controller, r888 is responsible for deciding what personal data is collected, the purposes for which it is used, how long it is retained and who it is shared with. We take this responsibility seriously and have built our data handling practices around the principle that your data should only ever be used in ways that genuinely benefit the operation of your r888 account or that are required by applicable law.

Our designated privacy contact can be reached at support@r888.world. If you have a specific privacy-related complaint or request, using the subject line "Privacy Request — [your registered email]" will help us route your message to the right team member promptly.

2. What Personal Data We Collect

r888 collects personal data in two main ways: information you provide directly when registering or using the platform, and information collected automatically as you use the site. Below is a clear breakdown of both categories.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you visit r888.world, certain technical data is collected automatically by our systems. This includes your IP address, browser type and version, device type, operating system, referring URL, pages visited on r888, time and duration of visits, game session data including stakes placed and game outcomes, and performance metrics such as page load times.

This automatically collected data helps r888 diagnose technical problems, prevent fraud and abuse, optimise platform performance and understand usage patterns in aggregate. It is not used to build individual marketing profiles.

3. Why We Collect Your Data — Purposes

r888 uses the personal data we collect for the following specific and clearly defined purposes:

• Account creation and management — To create and maintain your r888 player account, process your registration, verify your identity and manage your account settings and preferences.
• Payment processing — To process deposits and withdrawals in PKR via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card payments. Your payment data is shared with our payment service providers only to the extent necessary to process your transactions.
• Age and identity verification — r888 is legally and ethically obligated to verify that all players are at least 18 years of age and that their identity matches the information provided at registration. Verification data is used only for this purpose.
• Fraud prevention and security — To detect, prevent and investigate fraudulent activity, account takeovers, money laundering and other prohibited conduct. This includes analysis of login patterns, transaction behaviour and device fingerprinting.
• Platform operation and improvement — To understand how players use r888, identify technical issues, improve game performance and make product decisions based on genuine usage data rather than assumptions.
• Customer support — To respond to your queries, resolve disputes and maintain records of communications with the r888 support team.
• Responsible gaming compliance — To monitor gaming behaviour for signs of problem gambling, apply deposit limits and self-exclusion settings, and comply with our responsible gaming obligations.
• Marketing (with consent) — To send promotional emails and SMS messages about r888 offers, bonuses and new game launches, where you have explicitly opted in to receive such communications. You can withdraw this consent at any time.
• Legal compliance — To meet our obligations under applicable laws, including responding to lawful requests from regulatory or law enforcement authorities.

4. Legal Basis for Processing

r888 processes your personal data on the following legal grounds, depending on the specific purpose:

• Contractual necessity — Processing your identity, contact and financial data is necessary to perform the contract between you and r888 (i.e., to operate your account and process transactions). Without this processing, r888 cannot provide its services to you.
• Legal obligation — Age verification, KYC (know-your-customer) checks and anti-money-laundering monitoring are required by applicable regulations. r888 must comply regardless of any separate consent.
• Legitimate interests — Fraud prevention, platform security, technical performance monitoring and aggregate usage analysis are conducted on the basis of r888's legitimate interest in operating a secure and functional platform. These activities are proportionate and do not override your fundamental privacy rights.
• Consent — Marketing communications are sent only where you have given explicit consent. You can withdraw consent at any time by using the unsubscribe link in any marketing email, adjusting your communication preferences in your r888 account settings, or contacting support@r888.world.

5. Payment Data & Financial Information

r888 understands that financial data is among the most sensitive personal information Pakistani players entrust to us. We handle it accordingly.

When you make a deposit via Easypaisa or JazzCash, r888 stores only the reference information required to reconcile the transaction — typically a truncated account reference and transaction ID. The full mobile wallet credentials are never stored on r888 servers. IBFT bank transfers are processed through secure banking infrastructure and only the transaction reference and account name are retained for reconciliation purposes.

For Visa and Mastercard payments, r888 does not store full card numbers. Card payment processing is handled by PCI-DSS compliant payment service providers. r888 stores only a tokenised card reference for the purpose of processing future withdrawals to the same card.

r888's financial data records are subject to retention requirements under applicable accounting and anti-money-laundering regulations. Transaction records must typically be retained for a minimum of five years from the date of the transaction, even after your account is closed.

6. Who We Share Your Data With

r888 shares your personal data only where necessary and only with the categories of recipient described below. We do not sell your data. We do not share it for others' marketing purposes.

6.1 Payment Service Providers

Transaction data is shared with Easypaisa, JazzCash, NayaPay, SadaPay and card payment processors solely to process your deposits and withdrawals. These providers have their own privacy policies and operate their own independent security infrastructure. r888 selects payment partners with strong data protection credentials.

6.2 Identity Verification Providers

For KYC verification, r888 may use a third-party identity verification service to validate your CNIC and confirm liveness. The data shared is limited to what is required for the verification check. Verification providers are contractually bound to use your data only for the verification purpose and not to retain it beyond the minimum required period.

6.3 Technology Infrastructure Providers

r888 uses cloud hosting and technical infrastructure providers to operate the platform. These providers act as data processors under contract with r888 and have no independent right to use your personal data. All infrastructure contracts include data processing agreements with appropriate security requirements.

6.4 Regulatory and Law Enforcement Authorities

r888 will disclose personal data to regulatory bodies or law enforcement agencies where required by applicable law, court order or where r888 has a genuine good-faith belief that disclosure is necessary to prevent fraud, protect safety or comply with a legal obligation. r888 will, where legally permitted, notify affected players of such disclosures.

6.5 Fraud Prevention Networks

Where fraud is suspected, r888 may share relevant transaction and identity data with industry fraud prevention services to protect the platform and other players. Information shared for fraud prevention purposes is handled under strict confidentiality obligations.

7. Cookies & Tracking Technologies

r888 uses cookies and similar tracking technologies to operate the platform, remember your preferences and understand how players use the site. Here is a clear breakdown of the types of cookies in use:

Essential cookies cannot be disabled as they are necessary for the basic operation of r888. Analytics and marketing cookies can be managed through your browser settings. Disabling analytics cookies will not affect your ability to play on r888 but will reduce our ability to identify and fix technical issues.

r888 does not use tracking pixels or third-party advertising cookies for the purpose of serving personalised advertisements on external websites. Our marketing cookies are used only within the r888 platform to track the effectiveness of our own promotional campaigns.

8. How Long We Keep Your Data

r888 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data — Retained for the duration of your active r888 account relationship plus a 2-year period following account closure, to handle any disputes or regulatory queries that arise after closure.
• Transaction and financial records — Retained for a minimum of 5 years from the transaction date, as required by anti-money-laundering and financial record-keeping regulations.
• Identity verification documents — Retained for the duration of the account relationship and for 5 years after account closure, to support any post-closure KYC or regulatory enquiry.
• Support communications — Retained for 3 years from the date of the communication, to enable us to maintain continuity of service and resolve recurring issues.
• Marketing consent records — Retained for the duration of the active consent plus 3 years after consent is withdrawn, to demonstrate compliance with consent requirements.
• Technical and analytics data — Retained in aggregate form (without personal identifiers) indefinitely for platform improvement purposes. Individual-level technical logs are retained for 90 days.

When your data is no longer required for any of the above purposes, r888 securely deletes or anonymises it. Where anonymisation is used, the resulting data cannot be traced back to any individual and is not subject to data protection obligations.

9. Your Privacy Rights

As an r888 player, you have the following rights in relation to your personal data. These rights are free to exercise and r888 will respond to all valid requests within 30 days.

To exercise any of these rights, contact r888 at support@r888.world with the subject line "Privacy Rights Request". We may ask for identity verification before processing your request to ensure we are responding to the genuine account holder.

10. Security Measures

r888 implements a multi-layered approach to data security designed to protect your personal information from unauthorised access, disclosure, alteration or destruction. Key measures include:

• Encryption in transit — All data transmitted between your device and r888 is encrypted using 256-bit TLS/SSL. This applies to every page, not just payment pages.
• Encryption at rest — Sensitive data fields including identity document data and financial references are encrypted in the r888 database using AES-256 encryption.
• Password hashing — Player passwords are never stored in plain text. r888 uses a strong cryptographic hashing algorithm with per-account salting, meaning that even if our database were compromised, your actual password would not be exposed.
• Access controls — Access to player data within r888's internal systems is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-factor authentication — r888 supports two-factor authentication on player accounts and recommends all players enable it for additional login security.
• Penetration testing — r888's platform undergoes periodic penetration testing by independent security researchers to identify and remediate vulnerabilities before they can be exploited.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights, r888 will notify affected players promptly and take immediate steps to contain and assess the breach.

11. Children's Privacy

r888 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, you are not permitted to use r888 and you must not attempt to register an account or provide us with any personal information.

If r888 becomes aware that we have inadvertently collected personal data from a person under 18, we will delete that data immediately, close the associated account and — where applicable — report the matter to relevant authorities. r888 takes the protection of minors online seriously and actively maintains age verification procedures designed to prevent underage access.

If you are a parent or guardian and believe your child has registered on r888, please contact us immediately at support@r888.world with the subject line "Underage Account". We will investigate and respond within 24 hours.

12. Marketing Communications

r888 sends marketing communications — including promotional emails and SMS messages about bonuses, new games, seasonal offers and platform updates — only to players who have explicitly opted in to receive them. The opt-in is presented separately during registration and is never pre-ticked.

If you have opted in, you can withdraw your marketing consent at any time by:

• Clicking the "Unsubscribe" link in any marketing email from r888;
• Replying "STOP" to any marketing SMS from r888;
• Updating your communication preferences in your r888 account settings under Profile → Notifications; or
• Emailing support@r888.world with the subject line "Marketing Opt-Out".

Withdrawal of marketing consent does not affect your ability to use r888 and will not affect your eligibility for promotions displayed on the r888 Promotions page. Operational emails — such as account verification messages, deposit confirmations, withdrawal notifications and security alerts — are not marketing communications and will continue to be sent regardless of your marketing preferences.

13. Changes to This Privacy Policy

r888 may update this Privacy Policy from time to time to reflect changes in our data practices, new service features or changes in applicable law. The "Last updated" date at the top of this page reflects when the most recent revision was made.

When we make significant changes that materially affect how we process your personal data, we will provide advance notice to registered players via email to their registered address and via a prominent notice on the r888 website. For minor or clarificatory changes, we will update the policy without separate notification but will always update the revision date.

Continued use of r888 after any revision to this Privacy Policy constitutes your acceptance of the updated version. If you do not agree with a change, you should stop using r888 and request account closure before the revised policy takes effect. r888 will process any outstanding balance in accordance with the Terms and Conditions applicable at the time of your closure request.

14. Contact r888 About Privacy

If you have questions about this Privacy Policy, wish to exercise any of your data rights, have a concern about how your data has been handled, or wish to make a privacy complaint, please contact us. All privacy-related enquiries are handled by r888's designated privacy contact.

r888 is committed to resolving all privacy concerns fairly and promptly. If you feel your concern has not been adequately addressed, you may wish to seek guidance from an independent consumer protection or data protection advisory body in Pakistan.