Privacy Policy

Section 01

Introduction

This Privacy Policy ("Policy") describes how h988 ("h988", "we", "us", "our") collects, uses, stores, shares and protects the personal data of individuals ("you", "your", "User") who access or use the online gaming platform operated at https://h988.cam (the "Platform").

By registering an account, accessing the Platform or otherwise providing your personal data to h988, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein, to the extent that consent is the applicable lawful basis for such processing.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference. In the event of a conflict between this Policy and those documents on a matter of data privacy, this Policy prevails.

Section 02

Definitions

In this Policy, unless the context requires otherwise, the following terms have the meanings set out below:

• "Controller" means the entity that determines the purposes and means of processing personal data — in this context, h988.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed by h988 — typically a registered User or site visitor.
• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, date of birth, device identifiers and financial account references.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, alteration, restriction and deletion.
• "Processor" means a third party that processes personal data on behalf of h988 pursuant to a written data processing agreement.
• "Sensitive Data" means a subset of personal data carrying higher privacy risk — including identity document scans, financial verification data and, in certain KYC contexts, biometric data used for identity matching.
• "KYC" means Know Your Customer — the regulatory process by which h988 verifies the identity and age of Users prior to enabling withdrawals or certain high-value transactions.
• "Cookie" means a small data file placed on your browser or device to store session information, preferences or analytics identifiers.

Section 03

Data We Collect

h988 collects personal data in several ways: directly from you when you register or interact with the Platform, automatically through technical systems, and in certain cases from third-party verification partners. The categories of data collected are set out below.

3.1 Registration and Account Data

• Full legal name, date of birth and gender (where provided)
• Email address and phone number
• Residential address, including city and country (Karachi, Lahore, Islamabad, Rawalpindi and other Pakistani cities are typical residential references)
• Username and encrypted password
• Account currency preference (e.g. PKR)

3.2 Identity Verification (KYC) Data

• Government-issued photo identity documents (CNIC, passport, driving licence)
• Proof of address documents dated within three months
• Payment method verification documents
• Selfie or liveness-check images where required by our KYC provider

3.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates and transaction references
• Payment method references (e.g. partial account identifiers associated with Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — as contextual payment references only, not implying any endorsement or confirmed integration)
• Betting history, game session records and balance movements

3.4 Technical and Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Session timestamps, pages visited and click-path data
• Cookie identifiers and similar tracking technologies (see Section 10)

3.5 Communications Data

• Content of live chat transcripts, email correspondence and support tickets
• Complaint records and formal dispute documentation
• Marketing preferences and communication opt-in/opt-out status

3.6 Responsible Gambling Data

• Deposit limit settings, loss limit configurations and session timer preferences
• Self-exclusion requests and cooling-off period records
• Problem gambling assessment responses (where voluntarily provided)

Section 04

Lawful Basis for Processing

h988 processes personal data only where a valid lawful basis exists. The primary bases applicable to our processing activities are set out in the table below.

Section 05

How We Use Your Data

h988 uses the personal data we collect for the following purposes:

• Account Services: Creating and managing your account, authenticating logins, and maintaining your account preferences and history.
• Platform Operations: Processing bets and game sessions, recording results, managing your balance and executing deposits and withdrawals.
• Identity Verification: Completing KYC checks to confirm your identity, age and place of residence as required prior to withdrawals and certain account actions.
• Fraud and AML Detection: Monitoring account activity for unusual patterns, detecting potential money laundering, identifying multi-account abuse and preventing fraudulent transactions.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints and communicating account-related information.
• Responsible Gambling: Monitoring your gaming behaviour against responsible gambling indicators, applying limits you have set, and reaching out where our systems identify potential at-risk patterns.
• Legal and Regulatory Compliance: Retaining records as required by applicable anti-money-laundering regulations, responding to lawful requests from regulatory and law enforcement authorities.
• Marketing (with consent): Sending you promotional communications about h988 offers, new game releases, cricket and PSL-related promotions and platform updates — only where you have opted in, and only via channels you have consented to.
• Platform Improvement: Analysing aggregated usage data to improve platform performance, user experience and game catalogue relevance for Pakistani users.

h988 does not use automated decision-making processes — including profiling — that produce legal or similarly significant effects on Users without human oversight, save where required by regulatory anti-money-laundering screening obligations.

Section 06

Sharing & Disclosure

h988 does not sell, rent or trade your personal data to third parties. We share data only in the circumstances described below and only to the extent necessary for the stated purpose.

6.1 Service Providers (Processors)

We engage third-party Processors to support the operation of the Platform, including identity verification providers, payment gateway operators, fraud detection services, cloud hosting infrastructure providers, email delivery services and customer support software vendors. All Processors are bound by written data processing agreements requiring them to process your data only on h988's instructions, to maintain appropriate security measures, and not to sub-process data without h988's written authorisation.

6.2 Legal and Regulatory Authorities

h988 may disclose personal data to regulatory authorities, law enforcement agencies, financial intelligence units or courts where required to do so by applicable law, or where h988 has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of h988's business, personal data held by h988 may be transferred to the successor entity as part of that transaction. Users will be notified of any such transfer and any material changes to this Policy that result from it.

6.4 Aggregated Analytics

h988 may share aggregated, anonymised statistical data — from which no individual can be identified — with technology partners or for research purposes. Such data is not personal data and is not subject to the protections set out in this Policy.

Section 07

International Transfers

h988 operates internationally and uses cloud infrastructure and third-party service providers whose servers may be located outside your country of residence. As a result, your personal data may be transferred to, stored in or processed in jurisdictions other than Pakistan.

Where such transfers occur, h988 takes steps to ensure that adequate data protection safeguards are in place, including the use of standard contractual clauses, data processing agreements with appropriate security obligations, and selection of Processors in jurisdictions that offer a level of protection considered adequate by relevant standards.

By using the Platform, you acknowledge and agree to the transfer of your personal data to jurisdictions outside Pakistan where h988 or its Processors operate. If you have concerns about international data transfers, please contact us using the details in Section 15.

Section 08

Data Retention

h988 retains personal data for as long as is necessary to fulfil the purposes set out in this Policy and to comply with applicable legal, regulatory and accounting obligations. The key retention periods applicable to different categories of data are outlined below.

• Account Data: Retained for the duration of your active account and for a period of at least five years following account closure, in line with standard anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for the period required by the applicable licensing and AML obligations of h988's operating jurisdiction, typically five to seven years from the date of verification or account closure, whichever is later.
• Transaction Records: Retained for the period required by applicable financial record-keeping regulations, typically five years from the date of the transaction.
• Support Communications: Retained for three years from the date of the communication, or longer where the matter relates to an unresolved dispute or legal proceedings.
• Marketing Preferences: Retained until you withdraw consent or opt out, plus a reasonable period to evidence the withdrawal.
• Technical Logs: Retained for a rolling period of up to 12 months for security and fraud detection purposes, after which they are deleted or anonymised.

Once the applicable retention period expires and no legal basis for continued retention exists, h988 will securely delete or anonymise the relevant personal data.

Section 09

Security Measures

h988 implements and maintains appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser or app and h988's servers is encrypted using TLS (Transport Layer Security) protocols.
• Encryption at Rest: Sensitive personal data stored on h988's infrastructure is encrypted using AES-256 or equivalent standards.
• Access Controls: Access to personal data systems is restricted to authorised personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Security Monitoring: h988 employs continuous monitoring systems to detect and respond to anomalous activity, potential intrusions and data access events.
• Vendor Assessments: Third-party Processors are assessed for security compliance before engagement and subject to periodic review throughout the relationship.
• Incident Response: h988 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, h988 will notify affected Users and relevant authorities as required by applicable law.

While h988 takes these measures seriously, no system is entirely immune to security risks. You are responsible for maintaining the security of your own account credentials and for notifying h988 promptly if you suspect unauthorised access to your account.

Section 10

Cookies & Tracking Technologies

h988 uses cookies and similar tracking technologies (including local storage objects and session identifiers) to operate and improve the Platform. The categories of cookies we use are described below.

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your session state, remember your login between pages and enable core security features such as CSRF protection. You cannot opt out of strictly necessary cookies without disabling core platform functionality.

10.2 Performance and Analytics Cookies

These cookies collect anonymised or pseudonymised data about how Users interact with the Platform — pages visited, time spent, errors encountered and navigation paths. This data helps us identify and fix usability issues and optimise the platform experience for users accessing from Karachi, Lahore, Islamabad and across Pakistan.

10.3 Functional Cookies

These cookies remember your preferences — such as language settings, preferred sports markets (for example, cricket and PSL odds), and display options — to provide a more personalised experience on your next visit.

10.4 Marketing Cookies

Where you have consented to marketing communications, h988 may use cookies to track whether you have interacted with specific promotional content, to avoid showing you the same offer repeatedly and to measure campaign effectiveness. Marketing cookies are deployed only with your prior consent.

10.5 Managing Cookies

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse all cookies, accept only first-party cookies or delete existing cookies. Note that disabling certain cookies may impair the functionality of the Platform. Browser-based cookie controls do not affect strictly necessary session cookies required for secure login.

Section 11

Your Rights

Depending on the data protection laws applicable in your jurisdiction, you may hold some or all of the following rights in relation to your personal data held by h988. h988 will process all valid rights requests within 30 calendar days of receipt, subject to identity verification and any applicable legal exemptions.

• Right of Access: You may request a copy of the personal data h988 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: If any personal data h988 holds about you is inaccurate or incomplete, you may request that it be corrected or updated.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. This right is subject to legal retention obligations that may require h988 to retain certain data regardless of such a request.
• Right to Restrict Processing: You may request that h988 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is contested.
• Right to Object: You may object to processing based on h988's legitimate interests, including profiling for responsible gambling monitoring. h988 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a structured, machine-readable copy of your personal data for transfer to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact h988 via live chat on the Platform or by emailing [email protected] with the subject line "Data Rights Request". We will ask you to verify your identity before processing your request to ensure that personal data is not disclosed to or amended by an unauthorised person.

Section 12

Minors

The Platform is strictly intended for adults aged 18 years or older, or the higher minimum age required by the operator's licensing jurisdiction. h988 does not knowingly collect personal data from any person under the applicable minimum age.

Age verification is a mandatory step in the KYC process. If h988 becomes aware or has reasonable grounds to believe that personal data has been collected from a minor — whether through a false declaration at registration or otherwise — h988 will:

• Immediately suspend the account in question;
• Delete or securely quarantine the personal data collected, to the extent permitted by applicable law and regulatory obligations;
• Reverse any financial transactions associated with the account where technically and legally possible;
• Report the matter to the relevant regulatory authority where required to do so.

If you are a parent or guardian and believe that a person under the applicable minimum age has registered an account on the Platform, please contact h988 immediately via live chat or by emailing [email protected].

Section 13

Third-Party Links

The Platform may contain references to third-party services — such as payment method names including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — that are cited as contextual payment references only and do not imply endorsement, affiliation or confirmed operational integration by those providers.

To the extent that any third-party links or references appear on the Platform, h988 is not responsible for the privacy practices, content or data security of those third parties. This Policy applies solely to personal data processed by h988 in connection with the Platform. We encourage you to review the privacy policies of any third-party services you interact with independently of the h988 Platform.

Section 14

Policy Amendments

h988 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal or regulatory requirements, or the features and services offered on the Platform.

When material changes are made to this Policy, h988 will notify registered Users via email or via an in-platform notification prior to the changes taking effect. The "Last updated" date at the top of this page will be revised to reflect the date of the most recent amendment.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the amended terms, you should cease using the Platform and may request account closure by contacting our support team.

Section 15

Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or the manner in which h988 processes your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform — the fastest way to reach our support team, including during PSL match hours and late-night sessions from Karachi, Lahore and Islamabad.
• Email: [email protected] — for written data rights requests, formal privacy complaints and KYC-related correspondence. Please allow up to 30 days for a full written response to data rights requests, and up to 48 hours for general support enquiries.

When submitting a data rights request or privacy complaint, please include your account username, a clear description of your request or concern, and any relevant dates or transaction references. This helps us handle your matter efficiently and accurately.

Support agents communicate in English and Urdu. All formal data rights correspondence should be submitted in English to ensure accurate processing.