288ein Privacy Policy

288ein ("we", "us", "our" or "the Platform"), accessible at https://288ein.cam, is an English-language online betting and live casino information platform primarily serving users in Pakistan. We take the privacy and security of your personal data seriously and are committed to handling it in accordance with applicable data protection law and recognised international standards.

This Privacy Policy applies to all personal data that 288ein collects, processes or stores in connection with your use of the platform — including account registration, KYC verification, transaction records, customer support communications and browsing activity on our website.

By creating an account or continuing to use 288ein after the date on which this Policy comes into effect, you acknowledge that you have read and understood how your personal data will be handled as described in this document. If you do not agree with any part of this Policy, you should discontinue use of the platform.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, date of birth, email address, CNIC number, IP address and transaction history.
• "Processing" means any operation performed on personal data, whether automated or manual, including collection, storage, use, disclosure, deletion or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, 288ein.
• "Data Processor" means any third party that processes personal data on behalf of the Data Controller, such as a licensed KYC verification provider or cloud infrastructure partner.
• "Data Subject" means the identified or identifiable natural person to whom the personal data relates — you, the user.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, biometric data used for identification, health data, or data relating to criminal convictions.
• "Cookie" means a small text file stored on your device by a website to retain session state, preferences or analytics data.

288ein collects personal data in the following categories, depending on how you interact with the platform:

3.1 Account Registration Data

• Full legal name as it appears on your identity document.
• Date of birth (to verify age eligibility).
• Email address and, where provided, phone number.
• Residential address and country of residence.
• Preferred currency and language settings.
• Username and encrypted account credentials.

3.2 Identity Verification (KYC) Data

• Government-issued identity document — for Pakistani users, this is typically a valid CNIC or current passport. We do not store raw document images beyond the period required for verification and retention obligations.
• Proof of address documentation where required by operator policy.
• Selfie or liveness-check image for identity confirmation.
• Source-of-funds documentation for high-value transactions or where required by Anti-Money Laundering (AML) procedures.

3.3 Transactional Data

• Deposit and withdrawal amounts, timestamps and payment method references.
• Betting history including markets staked, odds, outcomes and bet values in PKR or other currencies.
• Bonus and promotion redemption records.
• Responsible gambling tool usage (e.g., limit settings, self-exclusion records).

3.4 Technical & Behavioural Data

• IP address, device type, operating system and browser type.
• Session duration, pages visited and features accessed on the platform.
• Geolocation data (country-level only) derived from IP address.
• Cookie identifiers and similar tracking data (see Section 10).

3.5 Communications Data

• Customer support chat transcripts and email correspondence.
• Complaint and dispute records.
• Marketing communication preferences and opt-in/opt-out records.

Personal data is collected through the following channels:

• Directly from you when you register an account, complete KYC verification, make a deposit or withdrawal, contact support or set responsible gambling preferences.
• Automatically through cookies, session tracking and server logs when you browse the platform.
• From licensed third-party KYC providers where identity verification is conducted through an integrated service. These providers operate under confidentiality agreements and applicable data protection law.
• From payment processors (for example, when a transaction is confirmed or reversed) to the extent necessary to manage your account balance accurately.
• From fraud-prevention and AML screening services where required by our license conditions.

288ein processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing is required to fulfil the agreement between you and 288ein — including account creation, transaction processing, KYC verification and withdrawal requests.
• Legal obligation: Processing is necessary to comply with applicable law, including AML legislation, KYC requirements and data retention obligations imposed by the operator's license jurisdiction.
• Legitimate interests: Processing is necessary for 288ein's legitimate business interests, including fraud prevention, platform security, improving platform performance and responsible gambling monitoring, where these interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on your consent — for example, for direct marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Your personal data is processed for the following specific purposes:

1. Creating, managing and securing your 288ein account.
2. Verifying your identity and age as part of KYC and responsible gambling obligations.
3. Processing deposits, withdrawals and bet settlements accurately.
4. Detecting, preventing and investigating fraud, money laundering and other illegal activities.
5. Complying with AML, KYC and other regulatory requirements imposed by our license jurisdiction.
6. Administering bonuses, promotions and loyalty programmes in accordance with published terms.
7. Monitoring responsible gambling indicators and applying safeguards where needed (e.g., deposit limits, self-exclusion).
8. Responding to customer support queries and resolving disputes.
9. Sending service-related communications (e.g., account verification emails, withdrawal confirmations).
10. Sending marketing communications where you have provided consent, or where permitted by applicable law.
11. Improving platform performance, user experience and content relevance through analytics.
12. Maintaining audit trails and records as required by applicable law.

288ein does not sell, rent or trade your personal data to any third party for marketing or commercial purposes. Your data may be shared in the following limited circumstances:

• Licensed KYC and identity verification providers — who process identity documents on our behalf under strict confidentiality obligations to confirm your identity and age.
• Payment processors and financial institutions — to facilitate deposits, withdrawals and fraud monitoring. Payment provider names (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) are used as familiar references only; these providers' own privacy policies govern how they handle transaction data on their side.
• AML and fraud-screening services — where processing is required to satisfy anti-money laundering obligations under applicable law.
• Cloud infrastructure and hosting providers — who store platform data on our behalf under data processing agreements that bind them to appropriate security and confidentiality standards.
• Regulatory authorities, law enforcement and courts — where disclosure is required by applicable law, court order or binding regulatory instruction.
• Professional advisers — including legal counsel, auditors and compliance consultants, where necessary to protect 288ein's legal rights or fulfil license obligations, subject to professional privilege or confidentiality obligations.

288ein retains your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law and our license conditions. The following general retention principles apply:

• Active accounts: Personal data is retained for the full duration of the account relationship and for a minimum period following account closure, as required by AML and data retention obligations (typically five to seven years, depending on jurisdiction).
• KYC documentation: Identity and verification documents are retained for the period required by applicable AML legislation following the end of the account relationship.
• Transaction records: Betting and payment records are retained for the period required by applicable financial record-keeping legislation.
• Support communications: Customer service records are retained for a reasonable period to manage disputes, complaints and service-quality monitoring.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of the consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer identify you.

288ein implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Our security measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption of sensitive data fields (including passwords) at rest using industry-standard algorithms.
• Strict role-based access controls limiting data access to authorised personnel only.
• Regular security assessments and vulnerability testing of platform infrastructure.
• Two-factor authentication (2FA) support for user account access.
• Monitoring for anomalous access patterns indicative of unauthorised access or account takeover attempts.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, 288ein will notify you without undue delay and take steps to mitigate the impact of the breach, in accordance with applicable law.

288ein uses cookies and similar tracking technologies (such as web beacons and local storage) to operate the platform, improve user experience and gather aggregate analytics. The following categories of cookies are used:

You can manage your cookie preferences through your browser settings. Disabling all cookies may impair certain platform functions. Our platform does not currently respond to "Do Not Track" browser signals, but you retain the right to object to non-essential data processing as described in Section 11.

Subject to the applicable data protection law in the operator's license jurisdiction and any overriding legal retention obligations, you hold the following rights in respect of your personal data:

To exercise any of these rights, please contact us using the details in Section 15. We will respond to all data-rights requests within the timeframe required by applicable law (typically within 30 calendar days of receipt). We may ask you to verify your identity before actioning a data-rights request to protect against unauthorised requests.

288ein is an adults-only platform. We do not knowingly collect or process personal data from individuals under the age of 18 — or the higher minimum age required by the operator's license jurisdiction. Age verification is a mandatory part of the KYC process and is applied to all accounts before withdrawals are processed.

If we become aware that personal data has been collected from a minor without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on our platform, please contact us immediately at the address in Section 15.

288ein operates through infrastructure that may be located in jurisdictions outside Pakistan. Where your personal data is transferred to a country outside the operator's license jurisdiction, we ensure that appropriate safeguards are in place to protect your data, including:

• Data processing agreements incorporating standard contractual clauses or equivalent safeguards.
• Use of third-party processors located in jurisdictions that provide an adequate level of data protection recognised by applicable law.
• Internal security controls applied consistently regardless of processing location.

For Pakistani users, please note that Pakistan's Personal Data Protection Act (where applicable and in force) may provide additional context for cross-border data transfers. 288ein does not provide legal advice on the application of Pakistani data protection law to your specific circumstances.

288ein reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing activities, or the services we offer. The "Last Updated" date at the top of this page reflects the most recent revision.

Where a material change is made to this Policy — for example, a change in how your data is used or shared — we will take reasonable steps to notify you, such as displaying a notice on the platform or sending an email to your registered address before the change takes effect.

Your continued use of the platform following publication of an updated Policy constitutes your acceptance of the revised terms. If you do not accept the changes, you should discontinue use and contact us to close your account.

If you have questions about this Privacy Policy, wish to exercise a data right, or wish to raise a complaint about how 288ein has handled your personal data, please contact us using the details below. We are committed to resolving all data-related enquiries promptly and transparently.

If you are not satisfied with our response to a complaint, you may have the right to escalate your complaint to the relevant supervisory or data protection authority in the operator's license jurisdiction. For Pakistani users, the applicable authority depends on the current status of Pakistan's data protection regulatory framework.