398win Privacy Policy — How We Protect Your Data

1 Who We Are

398win is an online sports betting and gaming platform serving adult players across Pakistan. The platform provides Sports Betting (including Cricket, PSL, T20 internationals, Football and Esports), Live Casino, Slots, Bingo and a Game Lobby. All services are accessed through the website at 398win.net.

When we refer to "398win", "we", "us" or "our" in this Privacy Policy, we mean the operators of the 398win platform. When we refer to "you", "your" or "the player", we mean any individual who visits the 398win website, creates an account, makes a deposit or interacts with the platform in any way.

This Privacy Policy applies to all personal data collected through the 398win platform and any communications between the platform and its players. It does not apply to third-party websites or services that may be linked to or from the 398win platform — those services have their own privacy policies and are not within our control.

2 Data We Collect

398win collects different categories of personal data depending on how you interact with the platform. Below is a clear breakdown of what we collect and when.

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions or biometric data beyond what may be contained in a CNIC for standard identity verification. Where verification documents are provided, they are stored securely and used only for the purposes of account verification and fraud prevention.

3 How We Use Your Data

Your personal data is used for specific, defined purposes. We do not use your data for any purpose that is incompatible with the reasons it was collected. The main purposes for which we process your data are:

• Account management: Creating and maintaining your player account, processing logins and keeping your profile information accurate.
• Transaction processing: Handling PKR deposits and withdrawals through JazzCash, Easypaisa, Raast, Bank Transfer and other supported payment methods.
• Identity verification: Confirming that you are who you say you are, that you meet the minimum age requirement of 18, and that your payment method belongs to you.
• Fraud prevention and security: Detecting unusual account activity, preventing multiple account registrations, identifying money laundering indicators and protecting the platform from abuse.
• Customer support: Responding to queries, resolving bet settlement disputes and handling account-related requests.
• Platform improvement: Analysing aggregate usage patterns to improve the betting and gaming experience, identify technical issues and develop new features.
• Responsible gaming: Monitoring play patterns to identify signs of problem gambling, enforcing self-exclusion requests and applying deposit limits set by the player.
• Marketing communications: Sending promotional offers, bonus notifications and platform updates to players who have opted in to receive them.
• Legal and compliance: Meeting any obligations under applicable platform policies, responding to lawful requests from authorities and maintaining records required for dispute resolution.

Your betting activity data — including the sports you bet on, the frequency of your sessions and the games you play — is used in aggregate and at the individual level to personalise your experience on the platform. For example, if you regularly bet on PSL or T20 cricket, you may see cricket-related promotions first. This personalisation is based on your actual usage and is intended to make the platform more relevant to your interests. You can opt out of personalised communications at any time through your account settings.

4 Legal Basis for Processing

For each type of personal data we process, there is a specific reason that justifies that processing. The main bases we rely on are:

• Contract performance: Processing your data is necessary to fulfil the service you have signed up for — running your account, processing bets and handling payments in PKR.
• Legitimate interests: We process certain data — such as technical and activity data — because we have a legitimate business interest in keeping the platform secure, preventing fraud and improving the service. We only rely on this basis where our interests are not overridden by your rights and expectations.
• Consent: Where we send you marketing emails or personalised promotional communications, we do so on the basis of your consent. You can withdraw this consent at any time by updating your preferences in your account settings or by contacting support.
• Compliance with obligations: Some data processing is necessary to comply with obligations that 398win has taken on as part of its platform rules, including identity verification and anti-fraud monitoring.

5 Sharing Your Data

398win does not sell your personal data to third parties. We share personal data only where it is necessary to operate the platform, and only with categories of recipients who are subject to appropriate confidentiality obligations. The main categories of recipients are:

• Payment processors: JazzCash, Easypaisa, Raast, banks and card processing providers receive the financial data necessary to process your deposit or withdrawal. These providers process data under their own privacy policies and are subject to their own security standards.
• Identity verification providers: Where we use a third-party service to assist with CNIC or document verification, that provider processes your verification data on our behalf under strict data processing agreements.
• Technology and hosting providers: The companies that provide hosting infrastructure, platform software and security services may have limited access to data as part of providing those services. They are contractually prohibited from using it for their own purposes.
• Customer support tools: If we use a third-party customer support platform to manage chat and email, that provider processes communication data on our behalf.
• Authorities: In circumstances where we receive a lawful request from a relevant authority, we may be required to disclose specific data. We will only comply with requests that are properly made and will inform you where we are permitted to do so.

All third parties with whom we share data are required to handle that data securely and to use it only for the purposes for which it was shared. We do not transfer personal data to parties in jurisdictions that do not maintain adequate data protection standards without appropriate safeguards in place.

6 Cookies & Tracking

398win uses cookies and similar tracking technologies on the platform website. A cookie is a small text file stored on your device when you visit a website. Cookies help us recognise your browser, keep your session active and understand how the platform is used.

• Essential cookies: Required for core platform functionality — keeping you logged in, maintaining your session and ensuring the platform loads correctly. These cannot be disabled without affecting your ability to use the platform.
• Functional cookies: Remember your preferences such as language settings, display options and notification choices so you do not have to set them again on each visit.
• Analytics cookies: Used to understand aggregate traffic patterns — which pages are visited most, how long sessions last and where players encounter errors. This data is used in anonymised or aggregated form to improve the platform.
• Marketing cookies: Used only where you have consented to receive personalised promotional content. These help us show you offers that are relevant to your activity — for example, a PSL betting bonus if you have placed cricket bets recently.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Blocking essential cookies will affect platform functionality. Blocking analytics or marketing cookies will not prevent you from using the platform but may mean your experience is less personalised.

7 Data Retention

We retain your personal data for as long as is necessary for the purposes set out in this Privacy Policy. The specific retention periods we apply are:

• Active accounts: Personal and account data is retained for the full duration of your account being open and active on the platform.
• Closed accounts: Following account closure, core account data — including identity information, transaction history and betting records — is retained for a period of five years. This is to enable the resolution of any disputes, to meet our own platform commitments and to prevent the circumvention of self-exclusion or ban decisions.
• Verification documents: Retained for the period of account activity plus a minimum of three years after account closure.
• Marketing data: Where you have opted out of marketing communications, we retain a record of your opt-out to ensure you are not contacted again. Your full profile data is not retained for marketing purposes after opt-out.
• Support communications: Chat and email records are retained for two years from the date of the last interaction, or longer if they are relevant to an open dispute.

Once the applicable retention period has passed, your data is securely deleted or anonymised so that it can no longer be linked back to you as an individual. Anonymised data may be retained indefinitely for statistical and platform improvement purposes.

8 Your Rights

As a player whose personal data is processed by 398win, you have a number of rights in relation to that data. These rights can be exercised by contacting the 398win support team at any time.

• Right of access: You can request a copy of the personal data we hold about you and information about how it is used.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you can request that it be corrected. For basic profile details such as your contact number, you can update these directly in your account settings.
• Right to erasure: You can request that we delete your personal data where it is no longer necessary for the purposes it was collected, where you withdraw consent (for consent-based processing) or where you object to processing based on legitimate interests. Note that we may not always be able to fulfil a deletion request in full — for example, where we need to retain data to resolve a dispute or comply with platform obligations.
• Right to restrict processing: You can ask us to pause the processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to object: You can object to the processing of your data where we rely on legitimate interests as our legal basis, and we will stop processing unless we can demonstrate compelling grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent — in particular, marketing communications — you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

9 Data Security

398win takes the security of your personal data seriously. We have put in place a range of technical and organisational measures designed to protect your data from unauthorised access, loss, misuse, alteration or disclosure. These measures include:

• TLS encryption for all data transmitted between your device and the 398win platform.
• Encryption of sensitive data at rest, including financial information and verification documents.
• Access controls that limit which team members can view personal data, based on the principle of least privilege.
• Regular security reviews and monitoring for unusual access patterns or potential intrusion attempts.
• Secure deletion procedures to ensure data is properly removed when retention periods expire.

No online platform can guarantee absolute security, and 398win does not make that claim. What we do commit to is maintaining security practices that are appropriate to the type and volume of data we handle, and responding swiftly and transparently if an incident occurs. If you suspect that your account has been accessed without your authorisation, contact support immediately and change your password.

10 Children

398win is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not register an account, make a deposit or access any betting or gaming service on the platform.

If we become aware that an account has been registered by or on behalf of a person under 18, we will close that account immediately, return any real-money deposits made in good faith after investigation, and delete the associated personal data as soon as it is safe to do so in accordance with our retention obligations.

If you are a parent or guardian and believe a minor in your household may have registered on 398win, please contact support immediately with as much detail as possible. We will investigate and take appropriate action without delay.

11 Changes to This Privacy Policy

398win may update this Privacy Policy from time to time to reflect changes in the way we operate the platform, changes in the services we offer, or for other operational, legal or regulatory reasons. When material changes are made, we will notify registered players by email or through an in-platform notification before the changes take effect.

The "Last updated" date at the top of this page reflects the most recent revision. We recommend checking this page periodically so that you remain aware of how your data is being handled. If you continue to use the 398win platform after the effective date of any changes, you are deemed to have accepted the updated Privacy Policy.

If you disagree with any material change to this Privacy Policy, you are entitled to close your account and request the deletion of your personal data subject to our retention obligations described in Section 7.

12 Contact Us

If you have a question about this Privacy Policy, want to exercise one of your data rights, or have a concern about the way 398win handles your personal information, please get in touch with the support team. We take all privacy-related queries seriously and aim to respond within 10 business days.

If you have contacted us about a privacy concern and are not satisfied with the response you have received, you have the right to raise your concern through whatever complaint mechanism is available to you under applicable local rules. We will always cooperate fully with any such process.