388ein Privacy Policy — Your Data, Protected

This Privacy Policy ("Policy") is published by 388ein ("388ein", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the 388ein website, mobile-optimised platform, and any related services accessible via 388ein.net and its subdomains (collectively, the "Platform").

This Policy should be read alongside the 388ein Terms & Conditions, which together form the complete legal framework governing your relationship with 388ein. By registering an account on 388ein or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

This Policy covers:

• Personal data collected when you register, deposit, play, withdraw, or contact support on 388ein;
• Data collected automatically through your use of the Platform (device data, usage logs, cookies);
• Data we receive from third-party payment providers and identity verification services;
• How we use, store, protect, and in limited circumstances share your personal data;
• Your legal rights in relation to your personal data held by 388ein.

This Policy does not apply to third-party websites or services that may be referenced or linked from the 388ein Platform. 388ein is not responsible for the privacy practices of any third-party service provider beyond what is described in this Policy.

388ein collects the following categories of personal data from users of the Platform:

388ein does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or medical history unless this is strictly required and consented to for responsible gaming assessment purposes.

388ein collects personal data through the following methods:

• Direct collection: Data you provide when completing the registration form, submitting KYC documents, making a deposit, requesting a withdrawal, or contacting the support team;
• Automated collection: Technical data collected automatically by the Platform when you access and use 388ein, including via cookies, server logs, and session tracking technology;
• Third-party providers: Identity data and fraud risk scores received from third-party KYC and identity verification services engaged by 388ein; payment confirmation and transaction reference data received from JazzCash, EasyPaisa, HBL, UBL, SadaPay, and other payment processors;
• Publicly available sources: In limited circumstances and for fraud prevention purposes, 388ein may cross-reference data against publicly available databases or sanctions lists.

388ein processes personal data for the following specific purposes:

• Account management: Creating, maintaining, and administering your 388ein account, including login authentication and profile management;
• Identity verification (KYC): Verifying that you are who you say you are, that you meet the age requirement (21+), and that your payment methods belong to you — as required by anti-money laundering (AML) regulations;
• Payment processing: Facilitating deposits and withdrawals via your chosen payment method (JazzCash, EasyPaisa, bank transfer, etc.) denominated in PKR;
• Gaming operations: Recording bet history, calculating game outcomes, managing bonus balances, and maintaining responsible gaming limit settings;
• Fraud prevention and security: Detecting and preventing fraudulent activity, collusion, bonus abuse, money laundering, and other prohibited conduct on the Platform;
• Regulatory compliance: Fulfilling obligations under applicable anti-money laundering, counter-terrorism financing, and data protection legislation;
• Customer support: Responding to queries, complaints, and requests submitted through the 388ein live chat or email support channels;
• Platform improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and user experience;
• Responsible gaming: Monitoring for signs of problem gambling behaviour and applying responsible gaming controls where appropriate;
• Marketing communications: Sending promotional offers and platform updates to users who have opted in to receive such communications — you may opt out at any time through your account settings.

388ein processes personal data on the following legal bases, depending on the purpose of processing:

• Contractual necessity: Processing required to fulfil the contract between you and 388ein — specifically, to create and manage your account, process payments, and deliver gaming services;
• Legal obligation: Processing required to comply with applicable laws, including AML/CFT regulations that require identity verification, transaction monitoring, and record-keeping;
• Legitimate interests: Processing carried out for 388ein's legitimate business interests, including fraud detection, security monitoring, and Platform improvement — where those interests are not overridden by your privacy rights;
• Consent: Processing carried out on the basis of your freely given, informed, and specific consent — for example, marketing communications. Consent can be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

388ein does not sell, rent, or trade your personal data to any third party for marketing purposes. Personal data is shared only in the following limited circumstances:

• Payment processors: Your payment details are shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and other relevant processors solely to facilitate transaction processing. These providers are bound by their own data protection obligations;
• KYC and identity verification providers: Identity documents and personal data may be shared with third-party KYC service providers engaged to verify user identity and assess fraud risk — strictly for the purpose of completing verification;
• Regulatory and law enforcement authorities: 388ein is legally required to disclose personal data and transaction records to competent authorities upon receipt of a lawful request — for example, in connection with AML investigations or court orders;
• Game software providers: In some cases, aggregated session data (not personally identifiable) is shared with game software providers to facilitate RNG certification and compliance audits;
• Corporate transactions: In the event of a merger, acquisition, or business reorganisation involving 388ein, personal data held by 388ein may be transferred to the acquiring entity — subject to equivalent data protection obligations.

All third-party service providers engaged by 388ein who have access to personal data are subject to data processing agreements obligating them to process personal data only on 388ein's documented instructions and in compliance with applicable data protection law.

388ein uses cookies and similar tracking technologies to operate the Platform effectively, improve user experience, and support fraud detection. A cookie is a small text file stored on your device when you visit the 388ein website.

388ein uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function — including session management, login authentication, and security tokens. These cannot be disabled without preventing basic Platform functionality;
• Functional cookies: Remember your preferences such as language settings, last visited game category, and responsible gaming limit configurations;
• Analytical cookies: Collect aggregated, anonymised data about how users navigate the Platform — page views, session duration, navigation paths — to help 388ein understand and improve platform usability;
• Security cookies: Used to detect suspicious session activity, brute-force login attempts, and account sharing patterns as part of 388ein's fraud prevention systems.

388ein does not use third-party advertising cookies and does not permit advertising networks to place tracking cookies on the 388ein Platform.

388ein retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure — to satisfy AML/CFT record-keeping obligations;
• Transaction and gaming records: Retained for a minimum of five (5) years from the date of each transaction, as required by financial and gaming regulations;
• KYC verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later;
• Support communication records: Retained for a minimum of two (2) years from the date of the last interaction;
• Anonymised analytical data: May be retained indefinitely in anonymised, aggregated form for platform improvement purposes, as it cannot be used to identify individual users.

Upon expiry of the applicable retention period, 388ein will securely delete or anonymise personal data in accordance with standard data destruction procedures. You may request early deletion of your data in accordance with Section 10 of this Policy, subject to any overriding legal obligation to retain the data.

388ein implements a layered approach to data security, combining technical safeguards, access controls, and organisational policies to protect personal data against unauthorised access, disclosure, alteration, or destruction.

Key security measures in place at 388ein include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the 388ein Platform;
• Encryption at rest for all stored personal data, including KYC documents and financial records;
• Role-based access controls ensuring that 388ein staff can only access personal data relevant to their specific job function;
• Two-factor authentication (2FA) available to all users for account login protection;
• Automated intrusion detection and session anomaly monitoring to identify suspicious access patterns in real time;
• Regular security audits and penetration testing conducted by qualified third-party security professionals;
• Staff data protection training to ensure all personnel handling personal data understand their obligations.

Subject to applicable data protection law, you have the following rights in relation to your personal data held by 388ein. To exercise any of these rights, contact us using the details in Section 14:

• Right of Access: You may request a copy of the personal data 388ein holds about you, along with information about how it is processed;
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or completed;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful — subject to 388ein's overriding legal obligations to retain certain data;
• Right to Restriction of Processing: You may request that 388ein restricts processing of your data in certain circumstances — for example, while a rectification request is being resolved;
• Right to Data Portability: You may request a structured, machine-readable copy of data you have provided to 388ein for the purpose of transferring it to another service provider;
• Right to Object: You may object to processing carried out on the basis of legitimate interests or for direct marketing purposes. Where the objection relates to direct marketing, 388ein will cease that processing immediately;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

388ein will respond to all valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further sixty (60) days, with written notification to you of the extension and the reasons for it.

If 388ein becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately and the associated account terminated. 388ein conducts age verification as part of the KYC process to prevent underage registration.

If you are a parent or guardian and believe that a minor has registered on 388ein or that their personal data has been collected without appropriate consent, please contact us immediately via the details in Section 14. 388ein will investigate and take appropriate action promptly.

388ein also encourages parents and guardians in Pakistan to use parental control software to prevent access to online gambling platforms by minors in their household.

The 388ein Platform integrates with third-party services including payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay), identity verification providers, and game software suppliers. When you interact with these third-party systems — for example, when completing a JazzCash deposit — your personal data may be subject to the privacy policy of that third-party provider in addition to this Policy.

388ein is not responsible for the privacy practices of third-party service providers beyond the terms of the data processing agreements 388ein holds with those providers. We encourage you to review the privacy policies of any third-party payment applications you use in connection with 388ein.

The 388ein Platform does not contain links to third-party websites for marketing or advertising purposes.

388ein reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services offered on the Platform.

Material changes to this Policy will be communicated to registered users via the mobile number or email address on file, or by prominent notice on the 388ein Platform, at least seven (7) days before the changes take effect. The "Last Updated" date at the top of this page will be revised accordingly.

We recommend that you review this Policy periodically to remain informed about how 388ein processes your personal data. Your continued use of the Platform after a policy update has been communicated constitutes acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise your data rights under Section 10, or need to report a privacy concern, please contact 388ein through the following channels:

• Live Chat: Available 24/7 via the chat widget on the 388ein Platform — the fastest route for urgent privacy concerns or account-related data queries;
• Email: [email protected] — for formal data subject access requests, erasure requests, or detailed privacy enquiries. Please include your registered username and a clear description of your request in your email.

388ein aims to acknowledge all privacy-related communications within forty-eight (48) hours and to provide a substantive response within thirty (30) days. For complex data subject access requests, we may request additional verification to confirm your identity before releasing or acting on personal data.

Players in Pakistan — whether based in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, or elsewhere — are welcome to contact us in English. Our support team is available around the clock and is familiar with the privacy concerns most relevant to Pakistani users.