Exch88 Privacy Policy — How We Handle Your Personal Data

01 Who We Are and What This Policy Covers

Exch88 operates exch88.app — an online entertainment platform offering Sports Betting, Casino, Live Casino and PKR payment services for adult users. When we say "we", "us" or "Exch88" in this policy, we mean the operator of exch88.app.

This policy covers all personal data collected when you visit the website, register an account, make a deposit or withdrawal using JazzCash, Easypaisa, Raast or Bank Transfer, place sports bets, play casino games, use Live Casino, or contact our support team. It also covers data collected automatically when you browse the platform.

This policy does not cover websites or services linked from exch88.app that are operated by third parties. Those services have their own privacy policies and we are not responsible for how they handle your data.

02 What Personal Data We Collect

The personal data we collect depends on how you interact with the platform. Here is a breakdown by category:

Registration and Account Data

• Full name as per your CNIC
• Date of birth (to verify you are 18 or older)
• Mobile phone number
• Email address
• Username and encrypted password
• City and province of residence

Identity Verification Data

For account verification we may collect a copy of your CNIC, a selfie or photo for identity matching, and proof of your payment method. This data is used solely for verification purposes and is handled with additional care.

Payment and Transaction Data

• JazzCash or Easypaisa mobile wallet number associated with your account
• Raast ID or bank account details for withdrawals
• Transaction history — deposits, withdrawals, and balance adjustments in PKR
• Payment method used for each transaction

We do not store full bank account credentials. Payment processing is handled through secure third-party channels. We only retain the reference data needed to match transactions to your account.

Betting and Gaming Activity Data

• Sports bets placed — event, market, odds, stake in PKR, and outcome
• Casino game sessions — game title, stakes, wins and losses in PKR
• Live Casino session records
• Bonus and promotion activity

Technical and Device Data

• IP address at time of login and transactions
• Device type, operating system and browser version
• Session timestamps and duration
• Pages visited and features used within the platform

Communications Data

If you contact our support team by email or through the platform's messaging channel, we retain a record of that conversation. This includes the content of your message, the date and time, and any attachments you provide. This data is used to resolve your query and improve our support service.

03 How and Why We Use Your Data

Exch88 uses the personal data we collect for specific, legitimate purposes. The table below sets out the main purposes and the data used for each:

We do not use your personal data for purposes beyond those listed above without informing you first. We do not sell your personal data to third parties for marketing purposes.

04 Legal Basis for Processing Your Data

We process your personal data on the following legal grounds depending on the purpose:

• Contract performance: Processing required to operate your account, handle PKR transactions, and deliver sports betting and casino services you have signed up for.
• Legal obligation: Processing required for identity verification, fraud prevention, anti-money laundering checks and other legal compliance requirements.
• Legitimate interests: Processing for fraud detection, platform security, and general analytics that improves the service — where those interests do not override your privacy rights.
• Consent: Where you have provided specific consent, for example to receive promotional communications about bonuses or new features on Exch88. You can withdraw consent at any time by contacting support.

05 Sharing Your Data with Third Parties

Exch 88 does not sell your personal data. We share data only in the following limited circumstances:

• Payment processors: JazzCash, Easypaisa, Raast and bank partners receive the minimum data necessary to process your PKR deposits and withdrawals. These providers operate under their own privacy obligations.
• Identity verification providers: Third-party verification services may process your CNIC and selfie data solely for the purpose of confirming your identity. They do not retain or use this data for any other purpose.
• Casino game providers: Game studios that supply Casino and Live Casino content receive session data required to operate the games. They do not receive your full personal profile.
• Technology and infrastructure providers: Hosting, security and platform technology partners may process certain technical data as part of delivering and protecting the platform. These partners are contractually bound to handle data securely and only as instructed.
• Legal and regulatory authorities: Where required by law, court order, or to protect against fraud or criminal activity, we may share relevant data with appropriate authorities.

06 How We Protect Your Data

Keeping your personal and financial data safe is something we take seriously at Exch88. The platform uses a combination of technical and operational safeguards:

• Encryption in transit: All data exchanged between your device and exch88.app is encrypted using TLS. This applies to login, deposits, withdrawals and all account activity.
• Encrypted password storage: Passwords are never stored in plain text. They are hashed using modern cryptographic methods so that even internal staff cannot read your password.
• Access controls: Access to personal data is restricted to staff and systems that have a legitimate need for it. Access logs are maintained and reviewed regularly.
• Payment data isolation: Full payment credentials are not stored on Exch88 servers. PKR transactions via JazzCash, Easypaisa, Raast and banks are processed through their own secure channels. We retain only the reference data needed to reconcile transactions.
• Fraud monitoring: Automated systems monitor for unusual login patterns, suspicious transaction activity, and other signals that may indicate unauthorised access or fraud. Suspicious activity triggers account review.
• Secure data disposal: Data that is no longer required for the purposes it was collected for is securely deleted or anonymised.

No online platform can guarantee absolute security. If you have reason to believe your account has been accessed without your permission, contact Exch88 support immediately so we can investigate and take action.

07 Cookies and Tracking Technologies

Exch88 uses cookies and similar technologies to operate the platform effectively, remember your session, and understand how users interact with the site. Here is what we use and why:

• Essential cookies: Required for the platform to function. These include session cookies that keep you logged in and security tokens that protect your account. You cannot opt out of essential cookies without disabling core platform functionality.
• Analytics cookies: Used to understand how players navigate the platform — which pages they visit, how long they spend, and where they encounter issues. This data is aggregated and helps us improve the experience for Pakistan players. You can disable analytics cookies through your browser settings.
• Preference cookies: These remember your settings and preferences so you do not have to reconfigure them on each visit.

You can manage cookie settings through your browser. Note that disabling essential cookies will affect your ability to log in and use the platform normally. For most players, the default browser settings will work fine — we do not use cookies for advertising or tracking across other websites.

08 Data Retention — How Long We Keep Your Data

We retain personal data for as long as it is needed for the purpose it was collected and to meet our legal obligations. The general retention periods are:

• Active account data: Retained for the lifetime of your account plus a reasonable period after account closure to handle any outstanding queries, disputes or legal requirements.
• Transaction records (PKR deposits and withdrawals): Retained for a minimum of five years from the transaction date for financial record-keeping and compliance purposes.
• Identity verification documents (CNIC, selfie): Retained for the period required by applicable verification and anti-money laundering obligations, typically five years from account closure.
• Communications and support records: Retained for up to three years from the date of the last communication, unless a longer period is required for an ongoing dispute or legal matter.
• Technical and device logs: Retained for up to 12 months for security monitoring purposes, after which they are deleted or anonymised.

When data is no longer required, it is securely deleted from our systems. Anonymised or aggregated data that cannot be linked back to you may be retained indefinitely for platform analytics and improvement.

09 Your Rights Over Your Personal Data

As a user of Exch88, you have rights over the personal data we hold about you. Here is a summary of those rights and how to exercise them:

To exercise any of these rights, contact Exch88 support with your registered account details. We will respond within a reasonable period. Some requests may require identity verification before we can act on them.

10 Responsible Gaming and Data

Exch88 uses certain account and gaming activity data as part of our responsible gaming commitment. This is not surveillance — it is a measure to protect players who may be showing signs of problematic play patterns.

Specifically, we may analyse deposit frequency, session length, betting patterns, and self-exclusion requests to identify accounts that may benefit from a reminder about responsible gaming practices, or to action a cooling-off or self-exclusion request made by the account holder.

This processing is carried out in the interests of player welfare and platform integrity, not for commercial profiling. No responsible gaming data is shared with advertisers or third parties outside of what is strictly necessary for the operation of the platform.

11 Children's Privacy

Exch88 is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. If we discover that a minor has registered an account or provided personal data, we will close the account immediately and delete the associated data as promptly as possible.

If you believe a minor has accessed the platform using your account or has registered their own account, please contact support immediately so we can investigate and take action.

12 Changes to This Privacy Policy

Exch88 may update this Privacy Policy from time to time to reflect changes in how we operate, changes in technology, or changes in applicable legal requirements. When we make a significant change, the "Last updated" date at the top of this page will be revised.

For material changes that significantly affect how we process your data, we will make reasonable efforts to notify active account holders — for example, via a notice when you next log in. However, it is your responsibility to check this page periodically to stay informed of the current policy.

Continuing to use Exch88 after a policy update constitutes acceptance of the revised terms.

13 Contact Us About Privacy

If you have questions about this Privacy Policy, want to exercise a data right, or have a concern about how your personal information is being handled, you can reach us through the support channel on exch88.app or by emailing the address shown in the footer of this page.

Please include your registered account username or phone number in your message so we can locate your account and respond efficiently. We aim to acknowledge all privacy-related enquiries promptly and resolve them within a reasonable timeframe.