Privacy Policy — 288in

288in ("we", "us", "our") operates the online gaming information platform accessible at https://288in.cam (the "Platform"). We are committed to protecting the privacy and personal data of every user ("you", "your") who accesses the Platform.

This Privacy Policy sets out, in clear and accessible language, the categories of personal data we collect, the purposes for which that data is processed, the legal basis for such processing, how long we retain data, the circumstances under which we share data with third parties, and the rights you hold as a data subject.

This Privacy Policy applies to all users of the Platform, including visitors from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and all other locations in Pakistan and internationally. By using the Platform, you acknowledge that you have read and understood this Policy. If you do not accept the terms of this Policy, you must discontinue use of the Platform.

This Policy should be read alongside our Terms & Conditions.

The following terms have the meanings assigned below throughout this Privacy Policy:

• Personal Data: Any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified directly or indirectly, including by reference to a name, identifier, location data, online identifier or one or more factors specific to that person.
• Processing: Any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure or destruction.
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data. For the purposes of this Policy, 288in is the Data Controller.
• Data Processor: A third party that processes personal data on behalf of the Data Controller under a contractual arrangement.
• Consent: A freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of their personal data.
• Cookies: Small text files placed on your device by a website to store browsing information and preferences.
• Platform / Website: The 288in online gaming information website at https://288in.cam.

288in is the Data Controller in respect of personal data processed through the Platform. As Data Controller, 288in determines the purposes for which personal data is collected and the manner in which it is processed.

Where 288in engages third-party service providers to assist with Platform operations (for example, analytics providers, hosting services or customer support platforms), those providers act as Data Processors and process data solely in accordance with 288in's documented instructions and applicable data protection obligations.

If you have any questions about 288in's role as Data Controller, or wish to exercise your data subject rights, please contact us using the details in Section 17 of this Policy.

288in collects personal data only to the extent necessary for the purposes described in this Policy. The categories of data we may collect are set out below:

288in collects personal data through the following means:

5.1 Directly from You

When you register an account, complete identity verification, submit a support request, respond to a survey or interact with any feature of the Platform that requires you to provide information, you supply personal data directly to us.

5.2 Automatically

When you access the Platform, certain technical and usage data is collected automatically through server logs, cookies and similar technologies (see Section 10 — Cookies & Tracking). This includes your IP address, browser characteristics, device identifiers and behavioural data such as pages visited and session duration.

5.3 From Third Parties

In certain circumstances, 288in may receive personal data from third parties, including:

• Identity verification and KYC service providers, who confirm the accuracy of documents you submit;
• Payment processors, who may share transaction reference data for reconciliation purposes;
• Analytics providers, who aggregate usage data to help us understand how users interact with the Platform;
• Fraud prevention services, which may cross-reference your data against known fraud indicators.

In all such cases, third parties are required to confirm that they have a lawful basis for sharing your data with us.

288in processes personal data for the following purposes:

• Account Management: Creating, maintaining and securing your registered account on the Platform, including verifying your identity and managing your account preferences.
• Service Delivery: Providing access to Platform features, educational content, payment guides, responsible gambling tools and customer support services.
• KYC & AML Compliance: Verifying your identity and assessing transactions to comply with anti-money laundering (AML) and know-your-customer (KYC) obligations under applicable law.
• Responsible Gambling: Administering deposit limits, loss limits, session reminders, self-exclusion requests and other player protection measures that you configure or that are applied in accordance with responsible gambling requirements.
• Transaction Processing: Recording and reconciling deposit and withdrawal transactions, including PKR-denominated transaction records.
• Platform Improvement: Analysing usage data to understand how users interact with the Platform, identify technical issues and develop improvements.
• Security: Detecting, preventing and investigating fraud, abuse, multi-accounting and other prohibited conduct.
• Communication: Responding to support requests, sending transactional notifications (e.g., account verification emails) and, where you have opted in, sending promotional communications.
• Legal Compliance: Retaining records as required by applicable law, responding to lawful requests from authorities and enforcing our Terms & Conditions.

288in does not use personal data for automated decision-making that produces legal or similarly significant effects without providing you with the ability to request human review.

288in processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contract with you — for example, creating and managing your account, verifying your identity and processing transactions.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including AML, KYC and responsible gambling obligations.
• Legitimate Interests: Processing is necessary for 288in's legitimate interests (and those of third parties), provided those interests are not overridden by your rights and interests. This includes fraud prevention, Platform security, analytics and service improvement.
• Consent: Where processing is based on your consent — for example, subscribing to marketing communications — you may withdraw that consent at any time by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

288in does not sell, rent or commercially trade your personal data. We may share your personal data with the following categories of recipients, solely for the purposes described in this Policy:

• Service Providers & Data Processors: Third-party companies that assist us with Platform hosting, analytics, KYC verification, fraud prevention, payment processing and customer support. These providers process data under contractual obligations and may not use your data for their own purposes.
• Regulatory and Law Enforcement Authorities: Where required by applicable law or a valid legal order, 288in may disclose personal data to government authorities, regulators or law enforcement agencies. We will endeavour to notify you of such disclosure where legally permitted to do so.
• Responsible Gambling Organisations: Where you request or consent to a self-exclusion or referral to a support organisation, limited data necessary to implement that arrangement may be shared with the relevant responsible gambling service.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of assets involving 288in, your personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

All data sharing arrangements are governed by appropriate contractual, legal or regulatory safeguards. References to Pakistani payment providers (Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah) on the Platform are for contextual illustration only; data is not systematically shared with these institutions unless directly required by a transaction you initiate.

Given the international nature of 288in's Platform and its service providers, your personal data may be transferred to, stored in and processed in countries outside your country of residence, including countries outside Pakistan. Such countries may have data protection laws that differ from those in Pakistan.

Where personal data is transferred internationally, 288in ensures that appropriate safeguards are in place to protect your information, which may include:

• Contractual clauses that impose equivalent data protection standards on the receiving party;
• Transfers to countries or organisations recognised as providing adequate levels of data protection by applicable regulatory standards;
• Other legally permitted transfer mechanisms.

You may request further information about the specific safeguards governing international transfers of your data by contacting us at [email protected].

288in uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are described below:

• Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as account authentication, session management and security. They cannot be disabled without affecting basic Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate the Platform — pages visited, time spent, error messages encountered and referral sources. This data helps us improve user experience. Where third-party analytics tools are used, data is processed in accordance with those providers' privacy policies.
• Preference Cookies: Store your selected language, display preferences and other customisations so the Platform can remember your settings between visits.
• Marketing Cookies: Used only where you have provided explicit consent. These cookies support the measurement of marketing campaign effectiveness. You may withdraw consent at any time.

You can control cookie settings through your browser. Please note that disabling certain cookies may affect Platform functionality. For detailed instructions on managing cookies in common browsers, refer to the browser's Help documentation.

288in retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory retention requirements. The following general principles govern our retention approach:

• Active Accounts: Personal data associated with active accounts is retained for the duration of the account relationship and for a reasonable period thereafter.
• Closed Accounts: Following account closure, 288in retains certain data (including identity records and transaction history) for the minimum period required by applicable AML, KYC and financial record-keeping laws. This period is typically five to seven years, depending on jurisdiction.
• Support Records: Customer support communications are retained for a defined period to facilitate dispute resolution, improve service quality and comply with legal obligations.
• Marketing Data: Data processed on the basis of consent for marketing communications is deleted promptly upon withdrawal of that consent, subject to any legal obligation to retain a record of the consent itself.
• Analytics Data: Aggregated and anonymised analytics data may be retained indefinitely as it does not constitute personal data after anonymisation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of identifying information.

Subject to applicable law, you have the following rights in relation to your personal data held by 288in. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving a verifiable request.

288in implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your browser and the Platform;
• Encryption of sensitive data at rest in 288in's systems;
• Role-based access controls that restrict personal data access to authorised personnel on a need-to-know basis;
• Regular security assessments and vulnerability reviews of Platform infrastructure;
• Two-factor authentication options for account access;
• Incident response procedures to identify, contain and report data breaches in accordance with applicable legal obligations.

Notwithstanding these measures, no system is entirely immune from security risks. In the event of a data breach that is likely to result in a risk to your rights and freedoms, 288in will notify affected users and, where required, the relevant supervisory authority in accordance with applicable law.

You are responsible for maintaining the confidentiality of your account credentials. If you suspect that your account has been accessed without authorisation, please contact [email protected] immediately.

The 288in Platform is strictly intended for adults aged 18 years or older — or the higher minimum age required by the applicable operator or license jurisdiction. We do not knowingly collect personal data from individuals who are under 18 years of age.

If 288in discovers or is notified that personal data has been collected from a minor without verifiable parental or guardian consent, we will take prompt steps to delete that data from our systems.

If you are a parent or guardian and believe that your child has provided personal data to 288in, please contact us immediately at [email protected].

288in is an English-language platform specifically serving users in Pakistan, including players in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and other cities and towns across the country.

Pakistan does not currently have a single, comprehensive data protection law equivalent to international standards such as the EU General Data Protection Regulation (GDPR). However, the Prevention of Electronic Crimes Act, 2016 (PECA) and other applicable Pakistani legislation include provisions relevant to the handling of personal and electronic data. 288in's data handling practices are designed to meet applicable international standards and, at minimum, comply with applicable Pakistani legal requirements.

References on this Platform to Pakistani financial services providers — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are provided for contextual illustration only. These institutions are not data processors of 288in unless you initiate a specific financial transaction that involves their services. 288in does not claim that any of these institutions endorses, supports or is affiliated with gambling-related activities.

Users in Pakistan are solely responsible for understanding and complying with applicable local law, including the Prevention of Gambling Act, 1977, when accessing gambling-related services. Nothing in this Privacy Policy constitutes legal advice.

288in reserves the right to update this Privacy Policy at any time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Where the changes significantly affect how we process your personal data, endeavour to notify registered users via email or a prominent notice on the Platform;
• Maintain a record of prior Policy versions, available upon request.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the publication of any update constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must discontinue use of the Platform and, if applicable, close your account.

For any questions, concerns or requests relating to this Privacy Policy — including the exercise of your data subject rights — please contact the 288in Data Privacy team using the details below. We will acknowledge receipt of your request promptly and provide a substantive response within 30 days.

If you are not satisfied with our response to a data subject request or privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us first so that we have the opportunity to address your concern directly.